CVE-2026-103290 Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
Authenticated staff users can exploit insufficient input validation in the ImageSize service to access local files outside intended directories.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103290?
CVE-2026-103290 is a medium-severity path traversal vulnerability in TryGhost Ghost, published on 1 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.
Weakness: CWE-35
Which versions are affected by CVE-2026-103290?
How do I fix CVE-2026-103290?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-103290 being exploited?
There is no known exploitation of CVE-2026-103290 in the wild and no public exploit code.
Sources
Also known as GHSA-phq3-mc75-42c3.