CVE-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
Authenticated administrators can exploit path traversal in locale settings to read arbitrary JSON files, exposing server configuration secrets.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104417?
CVE-2026-104417 is a medium-severity path traversal vulnerability in TryGhost Ghost, published on 2 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.
Weakness: CWE-22
Which versions are affected by CVE-2026-104417?
How do I fix CVE-2026-104417?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104417 being exploited?
There is no known exploitation of CVE-2026-104417 in the wild and no public exploit code.
Sources
Also known as GHSA-3h86-86h6-p5gj, MINI-935v-3xfc-h7rj.