ghost-blade (0.1.0), ohm (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2026-70593 via ghost (>=0.11.14, <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - sign-alex 1.0.1 Source cves: CVE-2026-70593 Source advisory: SNYK:JS-GHOST-18601956...

ghost-blade (0.1.0), ohm (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2026-70593 via ghost (>=0.11.14, <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - sign-alex 1.0.1 Source cves: CVE-2026-70593 Source advisory: OSV:GHSA-CJC9-Q5GF-327P...

CVE-2026-70593 Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...