Ghost CMS: 17 Vulnerabilities Disclosed, Including Code Execution and Script Injection Flaws
Key findings • 17 vulnerabilities in Ghost CMS disclosed on October 5th, 2026, ranging from Low to High severity. • High severity flaws include arbitrary code execution via crafted themes and…
Key findings
- 17 vulnerabilities in Ghost CMS disclosed on October 5th, 2026, ranging from Low to High severity.
- High severity flaws include arbitrary code execution via crafted themes and script injection via uploaded files.
- Issues span file handling, user role management, SSRF, and denial-of-service vulnerabilities.
- Most vulnerabilities are fixed in Ghost version 6.64.0; users urged to update immediately.
- CVE-2026-105650 (CVSS 8.1) allows untrusted script execution through bookmark cards.
On October 5th, 2026, a significant batch of 17 vulnerabilities was disclosed for Ghost, the popular Node.js content management system. These vulnerabilities, all disclosed within a single hour, range in severity from Low to High, with several posing serious risks to administrators and site integrity. The disclosures highlight issues across various functionalities, including file handling, user role management, and content embedding.
Several vulnerabilities revolve around improper handling of uploaded files and content imports. CVE-2026-105679, a High severity flaw, allowed any staff user to serve uploaded files with incorrect content types when using the default local storage adapter, potentially leading to cross-site scripting (XSS). Similarly, CVE-2026-105651, also High severity, permitted staff users to host arbitrary HTML on the site's domain by uploading non-image files as bookmark icons. A particularly dangerous vulnerability, CVE-2026-105650 (High, CVSS 8.1), allowed embedding untrusted scripts from attacker-controlled websites as bookmark cards, which could then execute in the Ghost editor, on the published site, and in newsletters. Another High severity flaw, CVE-2026-105644, involved SVG images in content imports being stored without sanitization, enabling attackers to host scripts on the site's domain if an administrator imported a crafted file.
Other critical issues impact user roles and access control. CVE-2026-105675 (High, CVSS 7.5) allowed staff users to discover secret tokens of pending invites, potentially escalating their privileges. CVE-2026-105678 (Medium) enabled staff users with specific roles to assign higher roles to other users, bypassing permission restrictions. CVE-2026-105680 (Medium) allowed staff with the Author role to delete posts and pages they did not author.
The batch also includes vulnerabilities related to server-side request forgery (SSRF) and local file access. CVE-2026-105682 (Low) in the webhooks feature allowed staff users to probe internal hosts. CVE-2026-105683 (Low) enabled staff users to access local files outside intended directories. Additionally, CVE-2026-105677 (High, CVSS 7.2) allowed an authenticated Administrator to execute arbitrary code via a crafted theme by exploiting how Ghost loads theme translation files. CVE-2026-105676 (Medium) allowed an authenticated Administrator to read sensitive JSON files outside the active theme's directory.
Denial-of-service vulnerabilities were also present. CVE-2026-105646 and CVE-2026-105645 (both Medium) could cause excessive CPU usage, making the Ghost server unresponsive, with the former requiring Administrator access for exploitation. Unauthenticated users could also abuse certain functionalities like Webmentions to make limited HTTP requests to internal network hosts on some configurations, as seen in CVE-2026-105648 and CVE-2026-105647 (both Medium). Finally, CVE-2026-105652 (Low) allowed staff users to determine the relative ordering of other staff users' hashed passwords, though this does not directly lead to password recovery.
The majority of these vulnerabilities have been addressed in Ghost version 6.64.0. However, specific fixes are noted for certain CVEs, with versions like 6.27.0, 6.44.1, 6.60.0, and 6.67.0 also mentioned as containing patches. Users are strongly advised to update to the latest available version to mitigate these risks. The coordinated disclosure of these numerous vulnerabilities underscores the importance of regular security audits and timely patching for content management systems like Ghost.
The disclosure of these 17 vulnerabilities in a single batch highlights a critical period for Ghost users. The range of severity, from low-impact information disclosure to high-impact code execution and privilege escalation, necessitates immediate attention. Administrators should prioritize updating their Ghost instances to the latest patched versions, paying close attention to the specific version numbers associated with each fix. The potential for attackers to exploit these flaws for data theft, unauthorized access, and system disruption makes prompt remediation essential for maintaining the security and integrity of Ghost-powered websites.
The related news coverage from Vypr Intelligence specifically highlighted four of these vulnerabilities, noting three as High severity, including SVG handling issues leading to script injection and arbitrary command execution. This independent reporting reinforces the severity and potential impact of this disclosure event.
The following CVE IDs were referenced in this article: CVE-2026-105683, CVE-2026-105682, CVE-2026-105681, CVE-2026-105680, CVE-2026-105679, CVE-2026-105678, CVE-2026-105677, CVE-2026-105676, CVE-2026-105675, CVE-2026-105652, CVE-2026-105651, CVE-2026-105650, CVE-2026-105648, CVE-2026-105647, CVE-2026-105646, CVE-2026-105645, CVE-2026-105644.