VulnSocial

CVE-2026-70593Disclosure

LOWCVSS 6.6 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBase and theme storage name handling. This issue is fixed in version 6.54.1.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-08-04); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-04: 1Mentions · 2026-08-05: 1Technical Details · 2026-08-05: 108-0408-05
Signal classification1 categories
Disclosure
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • Off By One Security@offby1security
    Disclosure

    We’re going to start posting CVE’s going forward that are discovered by ACID, starting with CVE-2026-70593. We will schedule streams to walk through some of the findings where we think it will add value to development teams. https://github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p https://acidapp.ai

    Post summary

    ACID announces its first CVE-2026-70593 and plans to explain findings in future streams, but provides no technical or exploit details.

    0411274.1K
    1.6K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-70593 Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads di… https://www.cve.org/CVERecord?id=CVE-2026-70593

    Post summary

    The tweet announces CVE-2026-70593, noting a staff‑user file‑write flaw in Ghost’s custom themes; no PoC, exploitation, or remediation details are provided.

    010001.3K
    57.9K followersView on X

Explore more

Back to dashboard