CVE-2022-28397Critical· 9.8▾ MidnightAn arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be upl…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.3%
3.3% → 3.5%
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.
ghost = 4.42.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105679High· 7.3Ghost is a Node.js content management system
CVE-2026-105649High· 7.3Ghost is a Node.js content management system
CVE-2026-105651High· 7.3Ghost is a Node.js content management system
CVE-2026-105644Medium· 6.8Ghost is a Node.js content management system
CVE-2026-53948Medium· 5.4Ghost: File Upload Content-Type Spoofing
GHSA-wj4w-mc24-pcfmHigh· 6.5Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature