CVE-2026-104418 in Ghost
Summary
by MITRE • 10/02/2026
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The identified vulnerability, designated as CVE-2024-37891 and commonly referred to in security circles under aliases such as Ghost from 6.10.3 before 6.64.0 remote code execution flaw, represents a critical security breach within the Ghost content management system platform. This specific weakness stems from an improper handling of theme translation files during the loading process, which allows for arbitrary code execution when exploited by authenticated users with administrative privileges. The core technical issue lies in how the application processes and interprets these translation assets without sufficient sanitization or validation checks against malicious payloads embedded within them.
From a technical perspective, the vulnerability is rooted in the mechanism that loads theme translations to support multilingual content rendering. When an administrator uploads a new theme package containing translated strings, the system parses these files to integrate language-specific text into the user interface and backend processes. However, due to insufficient input validation on the structure or content of these translation files, it becomes possible for an attacker to inject executable code snippets disguised as legitimate translation data. The application fails to distinguish between safe string literals and active script commands during this parsing phase, thereby allowing arbitrary JavaScript or server-side logic to be executed within the context of the Ghost process.
The operational impact of this vulnerability is severe due to its reliance on administrative authentication rather than unauthenticated access. While an attacker must first compromise administrator credentials to exploit this flaw, once achieved, they gain full control over the underlying server environment. This capability enables the execution of arbitrary commands, potentially leading to complete system compromise, data exfiltration, lateral movement within internal networks, or deployment of additional malware such as web shells and cryptominers. The ability to run code with the privileges of the Ghost application process means that attackers can read sensitive configuration files, access database contents containing user information and published content, and modify site settings to persist their presence.
This vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves injecting malicious executable code into a context where it is subsequently executed by the application logic. Furthermore, in terms of tactical classification within the MITRE ATT&CK framework, this exploit maps to T1505.003 Server Software Component: Web Shell and potentially T1059 Command and Scripting Interpreter depending on how the injected code interacts with the operating system. The attack vector is classified as Network-based but requires prior authentication, placing it in a higher privilege tier compared to unauthenticated remote code execution flaws.
Mitigation strategies primarily involve upgrading the Ghost installation to version 6.64.0 or later, where this parsing logic has been hardened to properly sanitize and validate translation file contents before processing. Organizations running older versions should immediately restrict administrative access through robust identity management practices, including multi-factor authentication and strict role-based access control policies. Additionally, implementing web application firewalls with rules capable of detecting anomalous patterns in uploaded theme packages can provide an additional layer of defense against exploitation attempts while patching efforts are underway. Regular auditing of installed themes and monitoring for unusual outbound network connections from the Ghost server process can also aid in early detection of potential compromise indicators associated with this vulnerability class.