Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.

The vulnerability exists in the /assets/built/ endpoint which improperly handles  directory traversal sequences (../../) allowing unauthorized file access.
 This can lead to disclosure of sensitive configuration files, environment variables,  and other critical application data.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via
    /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
    (CVE-2023-32235)

Ghost CMS versions prior to 5.42.1 are vulnerable to a Path Traversal allowing a remote attacker to read arbitrary files within the active theme's folder.

ID	Name	Product	Family	Severity
271812	Ghost CMS 5.42.1 - Path Traversal (CVE-2023-32235)	Nessus	CGI abuses	high
419890	SCA: security update for ghost (GHSA-wf7x-fh6w-34r6)	Tenable Cloud Security	SCA Checks	high
419890	SCA: security update for ghost (GHSA-wf7x-fh6w-34r6)	Tenable Self-Hosted Container Security	SCA Checks	high
114277	Ghost CMS < 5.42.1 Path Traversal	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2023-32235

high

Tenable Plugins

high

high

high

high