PT-2023-27222 · Ghost · Ghost

Ixsly · Published 2023-08-15 · Updated 2025-12-21 · CVE-2023-40028

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 5.59.1

Description The issue allows authenticated users to upload files that are symlinks, which can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation by looking for unknown symlinks within Ghost's content/ folder.

Recommendations For versions prior to 5.59.1, upgrade to version 5.59.1 to resolve the issue. As a temporary workaround, consider monitoring the content/ folder for unknown symlinks and restricting file upload capabilities to trusted users until the upgrade can be applied.

Exploit

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

BIT-GHOST-2023-40028

CVE-2023-40028

GHSA-9C9V-W225-V5RG

Affected Products

Ghost

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40028.json · Exploit
• 🔥 https://github.com/0xyassine/CVE-2023-40028 · Exploit
• 🔥 https://github.com/monke443/CVE-2023-40028-Ghost-Arbitrary-File-Read · Exploit
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-9c9v-w225-v5rg · Vendor Advisory
• https://github.com/TryGhost/Ghost/commit/690fbf3f7302ff3f77159c0795928bdd20f41205 · Patch
• https://osv.dev/vulnerability/CVE-2023-40028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40028 · Security Note
• https://osv.dev/vulnerability/BIT-ghost-2023-40028 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9c9v-w225-v5rg · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://t.me/cvenotify/57131 · Telegram Post
• https://twitter.com/ixSly/status/1691778310437474658 · Twitter Post
• https://twitter.com/SoBatistaCyber/status/2002781906060955669 · Twitter Post
• https://twitter.com/_kujen5/status/1911071817663692809 · Twitter Post
• https://twitter.com/gothburz/status/1873802585854910607 · Twitter Post