CVE-2023-40028

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-22
• CWE-59

• https://github.com/TryGhost/Ghost/commit/690fbf3f7302ff3f77159c0795928bdd20f41205Patch
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-9c9v-w225-v5rgVendor Advisory
• https://github.com/TryGhost/Ghost/commit/690fbf3f7302ff3f77159c0795928bdd20f41205Patch
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-9c9v-w225-v5rgVendor Advisory

Published

Aug 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40022Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2023-40023yaklang is a programming language designed for cybersecurity…7.5
• CVE-2023-40024ScanCode.io is a server to script and automate software comp…6.1
• CVE-2023-40025Argo CD is a declarative, GitOps continuous delivery tool fo…7.1
• CVE-2023-40026Argo CD is a declarative continuous deployment framework for…4.3
• CVE-2023-40027Keystone is an open source headless CMS for Node.js — built …5.3
• CVE-2023-40029Argo CD is a declarative continuous deployment for Kubernete…9.6
• CVE-2023-4003 One Identity Password Manager version 5.9.7.1 - An unauthen…6.8
• CVE-2023-40030Cargo downloads a Rust project’s dependencies and compiles t…6.1
• CVE-2023-40031Notepad++ is a free and open-source source code editor. Vers…7.8
• CVE-2023-40032libvips is a demand-driven, horizontally threaded image proc…5.5
• CVE-2023-40033Flarum is an open source forum software. Flarum is affected …7.1