PT-2026-104225
CVE-2026-104414
·
تاريخ النشر
2026-10-02
·
تاريخ التحديث
2026-10-13
الوصف من
CVSS 4.0
8.6
عاليةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Ghost versions 2.5.0 through 6.63.0
Description
A stored cross-site scripting issue exists where untrusted scripts can be injected into post content through oEmbed photo responses. An attacker can host a malicious oEmbed photo response; when the URL is embedded, the scripts are stored and subsequently executed within the Ghost editor, the published site, and newsletter emails. This can lead to the compromise of staff admin sessions.
Recommendations
Update Ghost to version 6.64.0 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾