PT-2026-104229

CVE-2026-104418

Published

2026-10-02

Updated

2026-10-13

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghost versions 6.10.3 through 6.63.x

Description Authenticated administrators can achieve remote code execution by abusing the theme translation file loading process. This occurs when an attacker with administrator privileges uploads a specially crafted theme containing malicious translation files, allowing the execution of arbitrary code on the server.

Recommendations Update Ghost to version 6.64.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Alemmi

Msegoviag

Tomer-Pl

Vendors

Affected products

Weakness enumeration