The vulnerability allows an authenticated Administrator to read arbitrary JSON files outside the active theme directory due to a path traversal bug in how Ghost loads translation files. This can expose server configuration secrets, including database credentials, and other sensitive information, leading to a confidentiality breach. The flaw is identified by CWE‑22 and CWE‑73, indicating improper path handling and potential open file read.

TryGhost Ghost versions from 1.20.0 through 6.63.x are affected. The issue was fixed in version 6.64.0, so any deployment running a Ghost instance older than 6.64.0 is vulnerable unless the patch is applied. This includes all Node.js based content management systems built with Ghost up to that version.

The CVSS score of 4.9 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation activity has been recorded to date. The likely attack vector requires authenticated Administrator privileges, so the risk is confined to environments where such credentials exist. An attacker could read sensitive files but cannot execute arbitrary code or modify the application beyond the information disclosure.