CVE-2023-32235

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory travers...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami ghost

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.42.1"}]}]

Références

advisory nvd.nist.gov
advisory github.com
patch github.com
web github.com