MEDIUM 4.9 NVD
CVE-2026-105676
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Admi
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0.
References
- https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02
- https://github.com/TryGhost/Ghost/issues/30635
- https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-m382-6jw4-fmp6
This medium severity vulnerability with a CVSS score of 4.9 was published on 2026-10-05 via NVD.
vulnfeed aggregates 7729 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.