External risk intelligence

Ghost CMS Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-28397

Ghost is a content management system designed for hosting websites and blogs. Such platforms are commonly deployed as public-facing web applications, making their administrative interfaces and upload modules network-reachable by design to facilitate content management.

Unrestricted File Upload

Ghost

4.42.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an arbitrary file upload vulnerability within the Ghost CMS file upload module. While the vendor indicates that only trusted users can upload and publish files, this vulnerability could allow attackers to execute arbitrary code if exploited. The primary concern is confirming the relevance and exposure of this vulnerability to your systems.

Uploads feature is vulnerable to code execution.
Confirms relevance and system exposure.
Assess impact and review trusted user access.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by uploading a specially crafted file through the application's file upload feature. This could potentially allow them to execute arbitrary code on the server, leading to a compromise of the Ghost CMS. However, the vendor notes that file uploads are intentionally restricted to trusted users.

No authentication required for access.
Upload a crafted file to the file upload module.
Potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an attacker to execute arbitrary code by uploading a crafted file to the Ghost CMS file upload module, potentially impacting system integrity and service availability.

System integrity and service availability.
Crafted file upload via network.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Owners of Ghost CMS deployments, likely web application or platform teams, should prioritize this. The first practical step involves confirming the presence of the affected technology, assessing its accessibility and business criticality, and identifying the accountable owner before planning remediation based on risk.

Application owners must address this.
Verify public-facing exposure first.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ghost CMS?

Ghost is a content management system built on Node.js used primarily for hosting websites and blogs. It provides tools for content creators to manage and publish digital publications. Because it is a web platform, its administrative and upload modules are often accessible over a network to allow authors to manage files and content.

How does CVE-2022-28397 work?

This vulnerability involves an arbitrary file upload weakness, classified as CWE-434. It occurs when a system fails to properly validate the type or contents of a file before saving it. In this case, the flaw allows an attacker to upload a specially crafted file to the Ghost CMS module, which the server may then execute, potentially granting the attacker the ability to run unauthorized code.

Do I need to be logged in to trigger this bug?

According to the CVSS vector associated with this CVE, the vulnerability can be triggered over the network without requiring authentication or user interaction. While the vendor notes that file uploads are intended for trusted users, the technical weakness allows the upload module to accept and process malicious files from external sources regardless of user status.

How do I know if my Ghost installation is at risk?

Halo Surface Signal indicates that Ghost CMS is typically deployed as a public-facing web application to enable remote content management. If your instance is accessible via the internet, it is more likely to be reachable by unauthorized parties. You should evaluate whether your deployment is exposed to the public network versus limited to an internal, protected environment.

What should I do to respond to this advisory?

Begin by confirming if your environment runs the affected version, Ghost CMS 4.42.0. Assess the accessibility of your instance and identify the team responsible for its maintenance. Once you have confirmed your exposure, coordinate with your technical team to plan for updates or security mitigations during your next scheduled maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.