An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HGhost
APPGhost4.42.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Powiązane podatności
CVE-2026-26980CRITICAL9.4PL ✓ten sam produkt
Ghost CMS: nieuwierzytelniony odczyt bazy danych przez SQL injection
CVE-2024-34451CRITICAL9.1PL ✓ten sam produkt
Ghost CMS – obejście limitu prób uwierzytelnienia przez nagłówki X-Forwarded-For
CVE-2024-23724CRITICAL9.0PL ✓ten sam produkt
Ghost CMS: stored XSS w pliku SVG umożliwia privilege escalation
CVE-2022-27139CRITICAL9.8ten sam produkt
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute ...
CVE-2026-29784HIGH7.5ten sam produkt
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections arou...