CVE-2026-105649

HIGHCVSS 7.3

Description

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.

Timeline

Published:October 5th, 2026 8:17 PM

Last modified:October 5th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 7.3 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-79 CWE-434

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/commit/80686226d23df56749f6b7ebb484850a8eba8072
https://github.com/TryGhost/Ghost/issues/30919
https://github.com/TryGhost/Ghost/releases/tag/v6.65.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-8575-cr6v-7jh4

Source: NIST NVD · Data may lag official sources by up to one minute