CVE-2026-105649 in Ghost
Summary
by MITRE • 10/06/2026
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within Ghost content management systems between versions 4.22.0 and 6.65.0 represents a critical failure in input validation and sanitization mechanisms regarding file uploads. Specifically, the system failed to properly sanitize SVG media thumbnails and images when they were uploaded using non-SVG file extensions. This technical flaw stems from an over-reliance on client-side or extension-based checks rather than robust content-type verification and deep inspection of the underlying data structure. By allowing files with misleading extensions to bypass security filters, the application inadvertently accepted maliciously crafted SVG payloads that contained executable JavaScript code embedded within their XML structures.
From a technical perspective, this issue is classified under CWE-20 Improper Input Validation and more specifically aligns with CWE-79 Cross-site Scripting (XSS). The core of the problem lies in how Ghost processed uploaded assets for thumbnail generation or direct storage. When an attacker uploads an SVG file disguised as another image type, such as a PNG or JPEG, the server processes it without applying necessary sanitization routines that would strip out script tags or event handlers like onload or onerror. Consequently, these malicious scripts become part of the static content served by the web application. Because the files are stored and subsequently rendered within the context of the site's own domain, they execute with full privileges associated with that origin, bypassing same-origin policy protections that typically mitigate cross-domain attacks.
The operational impact of this vulnerability is severe due to its potential for Stored Cross-site Scripting (CSP). Since any staff user, including those with low-privilege roles such as Contributors, can upload these malicious assets, the attack surface is significantly broadened. Once a malicious SVG is uploaded and viewed by an administrator or another privileged user within the Ghost dashboard, the embedded script executes in their browser session. This execution context allows attackers to perform actions on behalf of the victim, including stealing administrative cookies, session tokens, and authentication credentials. The compromise of these sessions can lead to full control over the content management system, enabling data exfiltration, defacement, or further lateral movement within the organization's infrastructure.
This vulnerability maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter via browser-based execution, specifically leveraging stored payloads for persistent access. The attack vector involves social engineering or opportunistic upload by a lower-privileged user who may be coerced or compromised themselves, thereby facilitating privilege escalation within the application layer. The persistence of the malicious script in the media library ensures that every subsequent view of the content poses a risk to any authenticated staff member accessing the dashboard, creating a continuous threat vector rather than a one-time exploit.
To mitigate this vulnerability and prevent similar issues, organizations must immediately upgrade Ghost installations to version 6.65.0 or later where these sanitization checks have been corrected. For environments that cannot update immediately due to compatibility constraints, implementing strict file upload validation at the web server level is essential. This includes enforcing MIME type verification against actual file content rather than relying solely on extensions and deploying Content Security Policy headers with a nonce-based script-src directive to restrict inline script execution even if malicious files are inadvertently stored. Additionally, regular security audits of media handling routines and implementing automated scanning for SVG-specific vulnerabilities in uploaded assets can provide an additional layer of defense against this class of input validation failures.