CVE-2026-104411: Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Ghost versions from 6.22.1 before 6.64.0 are affected when using the default local storage adapter. The issue concerns files uploaded to and served from the site's own domain.
What access does an attacker need to exploit it?
An attacker needs staff-user access and must be able to upload a file containing script content. Exploitation also requires another staff user to interact with the attacker-hosted content, as indicated by the required user interaction.
Who is at risk after a malicious upload?
Other staff users' Ghost admin sessions can be compromised when they encounter the uploaded script-bearing file. The vulnerability has high confidentiality and integrity impact, while availability impact is not indicated.
What version resolves the issue?
Upgrade Ghost to version 6.64.0 or later. Versions before 6.22.1 are not identified as affected by the provided advisory data.