ghost-as-middleware (=1.0.0), ghost-blade (=0.1.0) +3 more potentially affected by CVE-2022-27139 via ghost (>=0.11.14 <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - persistent-ghost =0.8.2 - sign-alex =1.0.1 Source cves: CVE-2022-27139 Source advisory: OSV:GHSA-FVC6-QJP7-M4G4...

CVE-2022-27139

creationtimestamp| type| source ---|---|--- 2022-04-12 20:23:09+00:00| seen| https://t.me/cibsecurity/40648...

CVE-2022-27139

Ghost v4.39.0 contains an arbitrary file upload vulnerability in its file upload module that can be triggered by a crafted SVG file. The vendor notes that SVG uploads require trusted authenticated users and, per Ghost security documentation, SVGs are not executable on the server and may only run ...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...