CVE-2026-70588 in Ghost

الملخص

بحسب MITRE • 05/08/2026

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• مسؤول: GitHub M
• حجز: 04/08/2026
• إفشاء: 05/08/2026
• الاعتدال: تمت الموافقة
• إدخال: VDB-385974
• CPE: جاهز
• CWE: CWE-79 (مؤكد)
• CVSS: 2.4 (VulDB)
• EPSS: 0.00000
• KEV: لا
• النشاطات: منخفض جدًا

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-70588
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70588
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-70588/