CVE-2026-105644: Ghost: Stored XSS via SVG Files in Content Imports
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.67.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ghost installations running versions 4.0.0 through 6.66.x are affected. Exploitation requires an Administrator to import attacker-crafted content containing an SVG file.
Does an attacker need an existing Ghost account or administrative access?
No existing account or administrative privilege is stated as necessary. The attacker must convince an Administrator to import the crafted file, making user interaction a required part of exploitation.
What is the potential impact after a malicious SVG is imported?
The imported SVG can host scripts on the site's domain. This may allow compromise of staff users' Ghost admin sessions.
What version fixes the issue?
Upgrade Ghost to version 6.67.0, which fixes the unsanitized handling of SVG images in content imports.