PT-2026-106178 · Ghost · Ghost
CVSS v3.1
6.8
متوسطة
| المتجه | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Ghost versions 4.0.0 through 6.66.0
Description
SVG images included in content imports are stored without sanitization. This allows an attacker to convince an Administrator to import a crafted file to host scripts on the site domain, which could lead to the compromise of staff users' admin sessions.
Recommendations
Update to version 6.67.0.
استغلال
إصلاح
XSS
Unrestricted File Upload
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Ghost