CVE-2022-28397 Arbitrary file upload in Ghost
Trusted users can upload malicious files to execute arbitrary code, though the vendor considers this behavior intentional.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-28397?
CVE-2022-28397 is a critical vulnerability in n/a, published on 12 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.
Weakness: CWE-434
Which versions are affected by CVE-2022-28397?
3 open source packages ship an affected version, including ghost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 4.42.0 | 4.42.1 |
ghost npm | All versions to 4.42.0 | None |
ghost npm | All versions to 4.42.0 | None |
Products include Ghost Ghost.
How do I fix CVE-2022-28397?
Upgrade ghost to 4.42.1 or later.
Is CVE-2022-28397 being exploited?
There is no known exploitation of CVE-2022-28397 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-27139 Arbitrary file upload in Ghost
- CVE-2022-41654 ghost vulnerable to unauthorized newsletter modification via improper access controls
- CVE-2026-26980 Ghost has a SQL Injection in its Content API
- CVE-2024-34451 Security feature bypass in n/a
- CVE-2024-23724 Ghost has possible Cross-site Scripting issue
Sources
Also known as BIT-ghost-2022-28397, GHSA-ffhq-g856-9f2p.