CVE-2026-104411 in Ghost
Summary
by MITRE • 10/02/2026
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The software Ghost, specifically in versions prior to 6.64.0 and starting from version 6.22.1, is susceptible to a stored cross-site scripting vulnerability that arises from improper validation of file uploads within the default local storage adapter. This security flaw permits authenticated staff users with upload privileges to inject malicious client-side scripts into the application environment by exploiting how the system determines content types based on file extensions rather than rigorous content inspection or MIME type verification. When an attacker uploads a file containing executable script code, such as an HTML document with embedded JavaScript, the server processes and stores this payload without adequately sanitizing the input or ensuring that the served content is strictly non-executable in browser contexts. The vulnerability leverages the trust relationship between the staff user role and the application's administrative interface, allowing the malicious file to be hosted on the site's domain under conditions where it will eventually be rendered by a victim's browser.
The operational impact of this vulnerability is significant because it facilitates persistent session hijacking and unauthorized access to sensitive administrative functions. Once the malicious script-bearing file is uploaded and stored, any subsequent staff user who views or interacts with content that triggers the loading of this specific asset will have their browser execute the injected code within the context of the Ghost application's domain. This execution environment allows the attacker-controlled scripts to bypass same-origin policies and access sensitive data such as session cookies, authentication tokens, and other protected resources stored in local storage or memory. Consequently, an adversary can manipulate the victim's administrative session, potentially leading to complete compromise of the blog instance, including unauthorized content modification, user management changes, or further exploitation of underlying server-side vulnerabilities through client-side actions that trigger specific API endpoints.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The stored nature of the attack means it persists on the target server and affects multiple users over time, distinguishing it from reflected XSS attacks that require immediate user interaction to trigger. In terms of tactical mapping within the MITRE ATT&CK framework for Enterprise, this behavior corresponds to T1059 Command and Scripting Interpreter via browser-based execution, specifically leveraging stored payloads as part of a broader campaign to gain persistent access or escalate privileges within the web application environment. The reliance on extension-derived content types highlights a failure in input validation logic where trust is placed solely on file metadata rather than actual content analysis, which is a common pitfall in media handling subsystems that prioritize convenience over security rigor.
Mitigation strategies for this vulnerability involve immediate upgrading to version 6.64.0 or later, where the developers have addressed the flawed content type determination logic and implemented stricter sanitization of uploaded files. In environments where an upgrade cannot be performed immediately, administrators should restrict file upload permissions to only those staff members who absolutely require them, thereby reducing the attack surface available to potential insiders or compromised accounts. Additionally, implementing a Content Security Policy that restricts script execution from specific directories can provide a layer of defense in depth by preventing the browser from executing scripts loaded from untrusted paths even if they are successfully uploaded. It is also advisable to configure web servers serving static assets to enforce strict MIME type sniffing prevention headers and ensure that files intended for media storage are not served with executable content types such as text/html or application/javascript unless explicitly required and sanitized by the application logic itself.