CRITICAL🇵🇱 Wersja polska

CVE-2022-27139

CVSS 9.8v3.1pub. 2022-04-12upd. 2024-11-21

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploading of SVG files to Ghost does not represent a remote code execution vulnerability. SVGs are not executable on the server, and may only execute javascript in a client's browser - this is expected and intentional functionality

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Ghost

    APP
    Ghost
    4.39.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2026-26980CRITICAL9.4PL ✓ten sam produkt

Ghost CMS: nieuwierzytelniony odczyt bazy danych przez SQL injection

CVE-2024-34451CRITICAL9.1PL ✓ten sam produkt

Ghost CMS – obejście limitu prób uwierzytelnienia przez nagłówki X-Forwarded-For

CVE-2024-23724CRITICAL9.0PL ✓ten sam produkt

Ghost CMS: stored XSS w pliku SVG umożliwia privilege escalation

CVE-2022-28397CRITICAL9.8ten sam produkt

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to exec...

CVE-2026-29784HIGH7.5ten sam produkt

Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections arou...