Publish Advisories

GHSA-4grm-h2qv-h6w6
GHSA-cjc9-q5gf-327p

Author: advisory-database[bot]

advisories/github-reviewed/2026/06/GHSA-4grm-h2qv-h6w6/GHSA-4grm-h2qv-h6w6.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4grm-h2qv-h6w6",
-  "modified": "2026-06-15T20:43:13Z",
+  "modified": "2026-08-04T21:50:03Z",
   "published": "2026-06-15T20:43:13Z",
   "aliases": [
     "CVE-2026-48748"
@@ -34,7 +34,7 @@
         }
       ],
       "database_specific": {
-        "last_known_affected_version_range": "<= 4.2.13.Final"
+        "last_known_affected_version_range": "<= 4.2.14.Final"
       }
     }
   ],
@@ -47,13 +47,29 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48748"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2026-48748"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488441"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/netty/netty"
     },
     {
       "type": "WEB",
       "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48748.json"
     }
   ],
   "database_specific": {

advisories/github-reviewed/2026/08/GHSA-cjc9-q5gf-327p/GHSA-cjc9-q5gf-327p.json

@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cjc9-q5gf-327p",
+  "modified": "2026-08-04T21:49:56Z",
+  "published": "2026-08-04T21:49:56Z",
+  "aliases": [
+    "CVE-2026-70593"
+  ],
+  "summary": "Ghost: Theme Upload Path Traversal",
+  "details": "### Impact\n\nA vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v0.10.0 up to v6.54.0.\n\n### Patches\n\nv6.54.1 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). \n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). \n\n### References\n\nGhost thanks Stephen Sims, Off By One Security for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "ghost"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.10.0"
+            },
+            {
+              "fixed": "6.54.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/TryGhost/Ghost/commit/fbaa92327e52607036a1e42204c9eadcc751d82c"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/TryGhost/Ghost"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-08-04T21:49:56Z",
+    "nvd_published_at": null
+  }
+}