CVE-2026-70593

CVE-2026-70593 affects Ghost (Node.js) versions 0.10.0–6.54.1. A vulnerability in custom themes allows a staff user to write files outside the uploads directory via path traversal in LocalStorageBase and theme storage name handling, enabling modification of installation behavior. The issue is fix...

CVE-2026-70593 Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

Malicious code in nagix-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279 package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines in index.js. The first...

MAL-2026-11525 Malicious code in nagix-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...

Malicious code in nagix-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...

NPM: Ghost: File Upload Content-Type Spoofing

NPM: Ghost: File Upload Content-Type Spoofing vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

GHSA-944X-PM95-3JPR Ghost: File Upload Content-Type Spoofing

Impact Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the...

EUVD-2026-39021

Ghost: File Upload Content-Type Spoofing...

boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-15830 via django (2.1.4)

django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-15307 via django (2.1.4)

django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-15830 via django (2.2.7)

django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-15307 via django (2.2.7)

django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

CVE-2026-18788

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-15830 via django (2.1.4)

django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-15830 via django (2.2.7)

django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

CVE-2026-18788 Trippo ResponsiveFilemanager dialog.php unrestricted upload

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

CVE-2026-18788

Trippo ResponsiveFilemanager

CVE-2026-18788

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

CVE-2026-18788 Trippo ResponsiveFilemanager dialog.php unrestricted upload

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

CVE-2026-18788

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...