CVE-2026-105651

Name of the Vulnerable Software and Affected Versions Ghost versions 5.94.0 through 6.63.0

Description Ghost, a Node.js content management system, allows staff users, including those with Contributor roles, to host arbitrary HTML on the site domain. This occurs when creating a bookmark card, as the system may store non-image files fetched from external websites as bookmark icons or thumbnails. This behavior could lead to the compromise of administrative sessions of other staff users.

Recommendations Update Ghost to version 6.64.0.