CVE-2022-27139 Arbitrary file upload in Ghost
Attackers with trusted authenticated access can upload crafted SVG files, potentially leading to client-side script execution, though vendor disputes server-side RCE.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-27139?
CVE-2022-27139 is a critical vulnerability in n/a, published on 12 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploading of SVG files to Ghost does not represent a remote code execution vulnerability. SVGs are not executable on the server, and may only execute javascript in a client's browser - this is expected and intentional functionality
Weakness: CWE-434
Which versions are affected by CVE-2022-27139?
3 open source packages ship an affected version, including ghost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 4.39.0 | 4.39.1 |
ghost npm | All versions to 4.39.0 | None |
ghost npm | All versions to 4.39.0 | None |
Products include Ghost Ghost.
How do I fix CVE-2022-27139?
Upgrade ghost to 4.39.1 or later.
Is CVE-2022-27139 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-27139 exists.
Other vulnerabilities in n/a
- CVE-2022-28397 Arbitrary file upload in Ghost
- CVE-2022-41654 ghost vulnerable to unauthorized newsletter modification via improper access controls
- CVE-2026-26980 Ghost has a SQL Injection in its Content API
- CVE-2024-34451 Security feature bypass in n/a
- CVE-2024-23724 Ghost has possible Cross-site Scripting issue
Sources
Also known as BIT-ghost-2022-27139, GHSA-fvc6-qjp7-m4g4.