CVE-2023-32235

Published: 2023-05-05T05:15Z

Last Modified: 2025-01-29T17:15Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt