ghost@5.32.0 vulnerabilities
The professional publishing platform
latest version
5.105.0
first published
13 years ago
latest version published
8 days ago
licenses detected
- >=0
Direct Vulnerabilities
Known vulnerabilities in the ghost package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
ghost is a publishing platform Affected versions of this package are vulnerable to Improper Access Control via some endpoints used for member actions. An attacker can perform member-only actions and read member information by exploiting the improper authentication mechanism. How to fix Improper Access Control? Upgrade | >=4.46.0 <5.89.5 |
ghost is a publishing platform Affected versions of this package are vulnerable to Improper Neutralization of Formula Elements in a CSV File during a member CSV export. An attacker can execute arbitrary commands by injecting maliciously crafted CSV content. How to fix Improper Neutralization of Formula Elements in a CSV File? Upgrade | <5.82.0 |
ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an SVG profile picture upload. A contributor user can cause scripts to be executed as owner. How to fix Cross-site Scripting (XSS)? Upgrade | <5.83.0 |
ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the How to fix Cross-site Scripting (XSS)? Upgrade | <5.76.0 |
ghost is a publishing platform Affected versions of this package are vulnerable to Arbitrary File Read which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Note:
Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's How to fix Arbitrary File Read? Upgrade | <5.59.1 |
ghost is a publishing platform Affected versions of this package are vulnerable to Directory Traversal due to allowing remote attackers to read arbitrary files within the active theme's folder via How to fix Directory Traversal? Upgrade | <5.42.1 |
ghost is a publishing platform Affected versions of this package are vulnerable to Information Exposure such that due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. How to fix Information Exposure? Upgrade | <5.46.1 |
ghost is a publishing platform Affected versions of this package are vulnerable to Access Restriction Bypass that allows contributors to view draft posts of other users via the NOTE: The vendor's position is that this behavior has no security impact. How to fix Access Restriction Bypass? There is no fixed version for | >=0.4.2-rc1 |
ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the How to fix Cross-site Scripting (XSS)? There is no fixed version for | >=0.0.0 |
ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the How to fix Cross-site Scripting (XSS)? There is no fixed version for | >=0.0.0 |
ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the How to fix Cross-site Scripting (XSS)? There is no fixed version for | >=0.0.0 |
ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the How to fix Cross-site Scripting (XSS)? There is no fixed version for | >=0.0.0 |