PT-2026-106196

CVE-2026-105677

·

Published

2026-10-05

·

Updated

2026-10-13

Description by

CVSS 3.1
7.2
High
MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ghost versions 6.10.3 through 6.63.0
Description An issue in the way the system loads theme translation files allows an authenticated Administrator to execute arbitrary code on the server by using a crafted theme.
Recommendations Update to version 6.64.0.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-94: Improper Control of Generation of Code (\'Code Injection\')
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Related identifiers
CVE-2026-105677
GHSA-JJ74-HC2Q-XRVM
BIT-GHOST-2026-104418
BIT-GHOST-2026-105677
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com