CVE-2022-28397
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. The vendor states that files can only be uploaded and published by trusted users, which is intentional.
Risk Assessment
The risk involves remote code execution by an authenticated attacker, potentially leading to full server compromise and data breach.
Recommendation
Restrict file upload access to trusted users only and implement strict file type and content validation. Consider upgrading to the latest version of Ghost CMS.
Original NVD description (English source)
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.