What is GHSA-phq3-mc75-42c3?

GHSA-phq3-mc75-42c3 is a security advisory published by GitHub Security Advisories with Medium severity. Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in...

Which CVE IDs does GHSA-phq3-mc75-42c3 cover?

GHSA-phq3-mc75-42c3 covers the following CVE IDs: CVE-2026-103290. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-phq3-mc75-42c3?

GHSA-phq3-mc75-42c3 has a CVSS v3 base score of 3.8, published by GitHub Security Advisories.

GHSA-phq3-mc75-42c3MediumCVSS 3.8

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in...

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-103290 →

📋 Description

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.

🔗 References (4)

https://github.com/TryGhost/Ghost/security/advisories/GHSA-83rp-q473-j88c
https://nvd.nist.gov/vuln/detail/CVE-2026-103290
https://www.vulncheck.com/advisories/ghost-6.14.0-before-6.27.0-path-traversal-via-imagesize
https://github.com/advisories/GHSA-phq3-mc75-42c3