CVE-2026-105649

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.

CVSS 3.1

7.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-25)

CWEs

CWE-79, CWE-434

Published

2026-10-05

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

Packages (OSV)

References

• https://github.com/TryGhost/Ghost/commit/80686226d23df56749f6b7ebb484850a8eba8072
• https://github.com/TryGhost/Ghost/issues/30919
• https://github.com/TryGhost/Ghost/releases/tag/v6.65.0
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-8575-cr6v-7jh4

Check your stackJSON