CVE-2026-104411

Name of the Vulnerable Software and Affected Versions Ghost versions 6.22.1 through 6.63.x

Description A stored cross-site scripting issue exists where staff users can host malicious scripts by uploading files that are served with extension-derived content types using the default local storage adapter. This allows an attacker to upload script-bearing files to the site domain to compromise the admin sessions of other staff users.

Recommendations Update Ghost to version 6.64.0 or later.