TI-2021-12482 Aliases CVE-2021-32817 GHSA-rwxp-hwwf-653v

File disclosure in express-hbs

LOW 33CWE-200Published 2021-05-14 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure, Code execution
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-94.

Summary

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .hbs appended to them. For complete details refer to the referenced GHSL-2021-019 report. Notes in documentation have been added to help users of express-hbs avoid this potential information exposure vulnerability.

Why it matters now

EPSS 0.01268 69th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed express-hbs (TryGhost): 2.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TryGhost	express-hbs	before 2.4.0	2.4.0	Patch available	CNA
—	express-hbs (npm)	up to 2.4.0	—	No fix listed	GHSA-rwxp-hwwf-653v

express-hbs VendorTryGhost Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA
express-hbs (npm) Vendor— Affected up to 2.4.0 Fixed in — No fix listed GHSA-rwxp-hwwf-653v

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:express_handlebars_project:express_handlebars::::::node.js::*	up to 5.3.2	Vulnerable	Express Handlebars Project

cpe:2.3:a:express_handlebars_project:express_handlebars:*:*:*:*:*:node.js:*:* Versions up to 5.3.2 Vulnerable ·Express Handlebars Project

Remediation

Fix · CNA express-hbs (TryGhost) Fixed in 2.4.0

Timeline

2026-10-02 Threatist record created from CVE-2021-32817
2026-10-03 Alias added: GHSA-rwxp-hwwf-653v

References

Exploit 1

https://securitylab.github.com/advisories/GHSL-2021-019-express-hbs/

Patch 1

https://github.com/TryGhost/express-hbs/commit/ff6fad6e357699412d4e916273314e5e7af1500e

Advisory 3

Other 2

TI-2026-21459 Ghost has a SQL Injection in its Content API CVSS 3.1CRITICAL 9.4
TI-2022-10277 An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows… CVSS 3.1CRITICAL 9.8
TI-2024-22785 Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit… CVSS 3.1CRITICAL 9.1
TI-2023-14843 Ghost vulnerable to disclosure of private API fields CVSS 3.1HIGH 7.5
TI-2025-09049 Ghost 6.0.6 - SSRF via oEmbed Bookmark CVSS 4.0MEDIUM 6.1
TI-2023-20918 Arbitrary file read via symlinks in Ghost CVSS 3.1MEDIUM 6.5

See all 109 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences