CVE-2023-40028 - CVE House
Back to Database
Status published Medium CVE-2023-40028

Arbitrary file read via symlinks in Ghost

Vulnerability Description

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40028

Credits & Attribution

No credits recorded in the NVD database.

References

More from TryGhost

View All →
CVE-2024-43409
Ghost's improper authentication allows access to member information and actions
Medium 6.5
CVE-2023-31133
Ghost vulnerable to disclosure of private API fields
High 7.5
CVE-2021-39192
Privilege escalation: all users can access Admin-level API keys
Medium 6.5
CVE-2021-32817
File disclosure in express-hbs
Medium 5.4
CVE-2021-29484
DOM XSS in Theme Preview
Medium 6.8

Affected Vendor

Affected Software

Ghost
Vulnerable Versions:
< 5.59.1

Timeline

Official Publish: August 15th, 2023
Last Modified: October 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact