CVE-2026-70592 is a path traversal vulnerability in Ghost CMS database export functionality affecting versions 1.20.1 through 6.54.1. The CVSS 5.5 score badly undersells the actual risk. This is a file-write primitive to arbitrary locations, gated only by admin authentication — and in Ghost's architecture, admin accounts have access to theme file editing, custom code injection, webhook configurations, and often Stripe/billing integrations for paid newsletters. Compromising a Ghost admin frequently means compromising the publication's entire content and revenue pipeline, not just the CMS.
The core issue isn't a careless filename parameter — it's a missing security abstraction. The export endpoint was designed under an 'admin = trusted operator' assumption rather than 'admin = high-privilege account that might be compromised.' Ghost shipped file-write capabilities behind authentication without layering traversal sanitization, path restrictions, or additional constraints on what an authenticated admin can write where. That's a design pattern failure, not a code smell.
The seven-year exposure window (roughly 2013–2024) is itself notable. Ghost's deployment profile shifted dramatically during this period from solo blogs to professional publications with third-party integrations. The same primitive hit different blast radii at different points in that timeline. Additionally, export endpoints are archaeological features — written once, forgotten, rarely audited — which makes them valuable targets for attackers with persistent presence who understand most security attention flows to higher-CVSS findings.
For defenders: verify your Ghost version is 6.54.1 or later. If you're on an affected version, prioritize this patch despite the misleading CVSS score. Treat admin account compromise as equivalent to root compromise given what Ghost admin roles can access. Review whether your deployment uses Ghost as an authentication backend or integration hub, as file-write could chain into reader-facing impact beyond local filesystem compromise. The patch in 6.54.1 sanitized the filename parameter and restricted write locations — update immediately.