Skip to content
Fencer Vulns
high 7.5

CVE-2023-32235 in the critical feed json

Path Traversal in Ghost

published 2023-05-05 3 y ago modified 2026-09-08 2 mo ago also BIT-ghost-2023-32235 , EUVD-2023-1639 , GHSA-wf7x-fh6w-34r6

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
39.1%
EPSS 39.1% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.

Patch / fix

  • npm ghost 5.42.1
  • bitnami ghost 5.42.1
  • ghost ghost 5.42.1

Timeline

  1. Published
  2. First public exploit (EDB-52408)

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

39.08% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52408 Ghost CMS 5.42.1 - Path Traversal webapps, 2025-08-11
  • Nuclei template Ghost CMS < 5.42.1 - Path Traversal nuclei detection template

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm ghost
<5.42.1
5.42.1
bitnami ghost
<5.42.1
5.42.1

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.