CVE-2025-27092: GHOSTS Path Traversal in NPC Photo Retrieval

GHOSTS is an open source user simulation framework from Carnegie Mellon's SEI, used in cyber training and exercises. The /api/npcs/{id}/photo endpoint serves profile images for simulated users and reads the file named in each NPC's photoLink field without sanitizing it.

An attacker creates an NPC with traversal sequences in photoLink and then requests its photo. The server returns any file the application process can read. GHOSTS 8.2.7.90 fixes the issue. There is no workaround.