TI-2023-20918 Aliases CVE-2023-40028 GHSA-9c9v-w225-v5rg

Arbitrary file read via symlinks in Ghost

HIGH 66CWE-22Published 2023-08-15 · Updated 2024-10-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.68954 99th percentileScored 2026-11-07

Fix Fixed Ghost (TryGhost): 5.59.1ghost (npm): 5.59.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TryGhost	Ghost	before 5.59.1	5.59.1	Patch available	CNA
—	ghost (npm)	before 5.59.1	5.59.1	Patch available	GHSA-9c9v-w225-v5rg

Ghost VendorTryGhost Affected before 5.59.1 Fixed in 5.59.1 Patch available CNA
ghost (npm) Vendor— Affected before 5.59.1 Fixed in 5.59.1 Patch available GHSA-9c9v-w225-v5rg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ghost:ghost::::::node.js::*	before 5.59.1	Vulnerable	TryGhost

cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:* Versions before 5.59.1 Vulnerable ·TryGhost

Remediation

Fix · CNA Ghost (TryGhost) Fixed in 5.59.1
Fix · GHSA-9c9v-w225-v5rg ghost (npm) Fixed in 5.59.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-40028
2026-10-03 Alias added: GHSA-9c9v-w225-v5rg

References

Patch 1

https://github.com/TryGhost/Ghost/commit/690fbf3f7302ff3f77159c0795928bdd20f41205

Advisory 2

Other 1

https://github.com/TryGhost/Ghost

TI-2026-21459 Ghost has a SQL Injection in its Content API CVSS 3.1CRITICAL 9.4
TI-2022-10277 An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows… CVSS 3.1CRITICAL 9.8
TI-2024-22785 Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit… CVSS 3.1CRITICAL 9.1
TI-2023-14843 Ghost vulnerable to disclosure of private API fields CVSS 3.1HIGH 7.5
TI-2025-09049 Ghost 6.0.6 - SSRF via oEmbed Bookmark CVSS 4.0MEDIUM 6.1
TI-2023-15533 Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active… CVSS 3.1HIGH 7.5

See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences