CVE-2026-105679

Name of the Vulnerable Software and Affected Versions Ghost versions 6.22.1 through 6.63.0

Description Ghost is a Node.js content management system. When using the default local storage adapter, the system fails to restrict the content type of uploaded files. This allows files uploaded by staff users to be served with a content type based on their file extension, which can be exploited to host scripts on the site domain and potentially compromise the admin sessions of other staff users.

Recommendations Update to version 6.64.0.