CVE-2022-28397: Ghost

Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days.

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.

Affected products

• Ghost Ghost: version 4.42.0 only

Published 2022-04-12. Last modified 2026-07-09.