PT-2026-106185

CVE-2026-105651

Published

2026-10-05

Updated

2026-10-13

Description by

CVSS 3.1

7.3

High

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ghost versions 5.94.0 through 6.63.0

Description Ghost, a Node.js content management system, allows staff users, including those with Contributor roles, to host arbitrary HTML on the site domain. This occurs when creating a bookmark card, as the system may store non-image files fetched from external websites as bookmark icons or thumbnails. This behavior could lead to the compromise of administrative sessions of other staff users.

Recommendations Update Ghost to version 6.64.0.

Exploitability

Exploit

Fix

Impacts

Researchers

5255Fgh

Sondt99

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type