CVE-2026-104413: Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Ghost versions from 5.94.0 before 6.64.0 are affected. The issue applies where staff users can create bookmark cards and cause external content to be fetched as card icons or thumbnails.
What access does an attacker need to exploit this?
An attacker needs a staff account with permissions available to Contributors or other staff users. Exploitation also requires another staff user to interact with the malicious stored content in the admin area.
What is the impact if exploitation succeeds?
A malicious bookmark card can store arbitrary HTML through its image-fetching behavior, resulting in stored XSS. This can compromise the admin session of another staff user, affecting confidentiality and integrity.