CVE-2026-105676

4.9 Moyenne

Publiée le 05/10/2026 à 22:17 · Modifiée le 06/10/2026 à 17:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0.

Traduire en français

Produits concernés

TryGhost Ghost

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.9 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-22
CWE-73

Références

https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02
https://github.com/TryGhost/Ghost/issues/30635
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-m382-6jw4-fmp6

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories