The vulnerability resides in Ghost’s database export endpoint, which accepts an administrator-supplied filename and fails to reject path separators. This path‑traversal flaw allows an admin to specify an arbitrary filesystem path, enabling overwriting of any file on the server. The result is a breach of data integrity and availability, classified as CWE-22, but it does not provide remote code execution.

TryGhost Ghost installations from version 1.20.1 through 6.54.0 are susceptible. The flaw was fixed in v6.54.1; any system running an earlier version is potentially vulnerable.

The CVSS base score of 5.5 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires administrator privileges and access to the database export API, so an attacker with an admin account can craft a malicious filename to overwrite critical files. While there is no direct code‑execution vector, the ability to modify files can lead to denial of service, data tampering, or supply‑chain compromise.