CVE-2026-104417 is a path traversal vulnerability in TryGhost Ghost affecting versions >=1.20.0 and <6.64.0. It occurs in the theme translation file loading mechanism, allowing authenticated administrators to manipulate the locale setting to access JSON files outside the intended theme directory. This improper limitation of pathname access can lead to exposure of server configuration secrets. The vulnerability requires high privileges (authenticated admin) and does not require user interaction.

Exploitation allows an authenticated administrator to read arbitrary JSON files outside the active theme directory. This can lead to disclosure of sensitive server configuration secrets, potentially aiding further attacks or information leakage. The impact is limited to users with administrator privileges and does not allow remote unauthenticated exploitation.

A fix is available in Ghost version 6.64.0 and later. Users should upgrade to version 6.64.0 or newer to remediate this vulnerability. No additional mitigation steps are indicated.