PT-2026-104228

CVE-2026-104417

Published

2026-10-02

Updated

2026-10-13

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.0 through 6.63.x

Description A path traversal issue exists in the theme translation file loading process. This allows authenticated administrators to read JSON files located outside the active theme directory by manipulating the locale setting, which can lead to the exposure of server configuration secrets.

Recommendations Update Ghost to version 6.64.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Dong2209

Msegoviag

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path