Every CVE Search/ Get API key

CVE-2023-40028

Arbitrary file read via symlinks in Ghost

4.9 MediumPublic exploitFix available

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

69.0%Up 68.9 points since Aug 16, 2023
90%50%10%1%

What each source reports

CVE List Score used 4.9

Arbitrary file read via symlinks in Ghost

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-40028
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2023-2256 4.9

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
EUVD-2023-2256
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-9c9v-w225-v5rg 4.9

Ghost vulnerable to arbitrary file read via symlinks in content import

Impact

A vulnerability in Ghost allows authenticated users to upload files which are symlinks. This can be exploited to perform an arbitrary file read of any file on the operating system.

Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder

Vulnerable versions

This security vulnerability is present in Ghost ≤ v5.59.0.

Patches

v5.59.1 contains a fix for this issue.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-9c9v-w225-v5rg
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
NVD 4.9

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-40028
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
OSV 4.9

Arbitrary file read via symlinks in Ghost

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-40028
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-9c9v-w225-v5rg 4.9

Ghost vulnerable to arbitrary file read via symlinks in content import

Impact

A vulnerability in Ghost allows authenticated users to upload files which are symlinks. This can be exploited to perform an arbitrary file read of any file on the operating system.

Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder

Vulnerable versions

This security vulnerability is present in Ghost ≤ v5.59.0.

Patches

v5.59.1 contains a fix for this issue.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-9c9v-w225-v5rg
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
OSVBIT-ghost-2023-40028 No score

Arbitrary file read via symlinks in Ghost

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
BIT-ghost-2023-40028
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ghost
npm
 before 5.59.1
5.59.1
ghost
Bitnami
 before 5.59.1
5.59.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBGhost CMS 5.59.1 - Arbitrary File Read2025-08-11
PoC in GitHub0xDTC/Ghost-5.58-Arbitrary-File-Read-CVE-2023-400282024-12-12
PoC in GitHub0xyassine/CVE-2023-400282024-03-23
PoC in GitHubStp1t/CVE-2023-400282026-01-22
PoC in GitHubbuutt3rf1y/CVE-2023-400282025-04-14
PoC in GitHubgodylockz/CVE-2023-400282025-01-20
PoC in GitHubmonke443/CVE-2023-400282024-12-21
PoC in GitHubrehan6658/CVE-2023-400282025-02-02
PoC in GitHubrvzsec/CVE-2023-400282024-12-28
PoC in GitHubsudlit/CVE-2023-400282024-12-13
PoC in GitHubsyogod/CVE-2023-400282025-03-07

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-40028 is a medium vulnerability (CVSS 4.9) in Ghost, published August 15, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 69.0%, the 99th percentile. Fixed in ghost 5.59.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open