CVE-2023-40028

Deeper analysis

Ghost is an open source content management system affected by CVE-2023-40028 in all versions prior to 5.59.1. The flaw permits authenticated users to upload files that are symbolic links, which the application then follows during file operations. This stems from insufficient validation of uploaded content against symlink or path traversal risks (CWE-22 and CWE-59), enabling reads outside the intended content directory on the underlying host operating system. The issue carries a CVSS 4.9 score reflecting network attack vector, low complexity, and high-privilege requirements.

An authenticated attacker with the ability to upload files can place a symlink inside Ghost's content/ directory and subsequently retrieve the contents of any readable file on the host filesystem. Exploitation therefore yields arbitrary file disclosure but does not directly permit modification or service disruption. Because the vector requires authenticated access, the primary threat actors are users already holding accounts with upload privileges, such as editors or administrators.

The official Ghost security advisory GHSA-9c9v-w225-v5rg and the accompanying patch commit 690fbf3f7302ff3f77159c0795928bdd20f41205 state that version 5.59.1 contains the fix. Administrators are advised to upgrade immediately; the advisory also recommends inspecting the content/ folder for unrecognized symlinks as an indicator of prior exploitation. No workarounds are documented.

The EPSS score has reached a peak of 0.7970 with a current value of 0.7761, indicating sustained exploitation interest following disclosure.