{"id":"CVE-2023-32235","aliases":["BIT-ghost-2023-32235","EUVD-2023-1639","GHSA-wf7x-fh6w-34r6"],"status":"published","title":"Path Traversal in Ghost","description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.39078,"percentile":0.98605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2023-05-05T00:00:00Z","modified":"2026-10-28T02:31:10Z","exploits":[{"source":"exploitdb","id":"EDB-52408","title":"Ghost CMS 5.42.1 - Path Traversal","type":"webapps","platform":"multiple","date":"2025-08-11","url":"https://www.exploit-db.com/exploits/52408"},{"source":"nuclei","id":"CVE-2023-32235","title":"Ghost CMS \u003c 5.42.1 - Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32235.yaml"},{"source":"pocgithub","id":"AXRoux/Ghost-Path-Traversal-CVE-2023-32235-","title":"AXRoux/Ghost-Path-Traversal-CVE-2023-32235-","date":"2023-07-09","url":"https://github.com/AXRoux/Ghost-Path-Traversal-CVE-2023-32235-"}],"fixes":[{"ecosystem":"npm","package":"ghost","fixed_in":["5.42.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"ghost","fixed_in":["5.42.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ghost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.42.1"}]}]},{"source":"osv","ecosystem":"npm","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.42.1"}]}]}],"products":[{"vendor":"ghost","product":"ghost"}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced8884579598b0f","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/TryGhost/Ghost/compare/v5.42.0...v5.42.1","tags":["x_transferred","Release Notes","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32235","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wf7x-fh6w-34r6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32235.json","tags":["advisory"]},{"url":"https://github.com/TryGhost/Ghost","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-32235","description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.","status":"published","published":"2023-05-05T00:00:00Z","modified":"2025-01-29T16:29:07.429Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-1639","description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.","status":"published","published":"2023-05-05T00:00:00Z","modified":"2025-01-29T16:29:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:09.89712Z"}],"ghsa":[{"id":"GHSA-wf7x-fh6w-34r6","title":"Path Traversal in Ghost","description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.","status":"published","published":"2023-05-05T06:30:32Z","modified":"2023-11-10T05:00:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2023-32235","description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.","status":"published","published":"2023-05-05T05:15:09.293Z","modified":"2026-06-17T05:58:22.5Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:01.131774Z"}],"osv":[{"id":"CVE-2023-32235","description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.","status":"published","published":"2023-05-05T00:00:00Z","modified":"2026-10-28T02:31:10.39634332Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-wf7x-fh6w-34r6","title":"Path Traversal in Ghost","description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.","status":"published","published":"2023-05-05T06:30:32Z","modified":"2023-12-06T01:03:01.557084Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"BIT-ghost-2023-32235","description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.","status":"published","published":"2024-03-06T10:52:21.101Z","modified":"2026-09-08T08:47:33.449236495Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}