CVE-2026-105644: Ghost: Stored XSS via SVG Files in Content Imports
Impact
SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions.
Vulnerable versions
This vulnerability is present in Ghost from v4.0.0 up to v6.65.0.
Patches
v6.67.0 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks Zhixi "Jace" Sun, independent security researcher, for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Other sources
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.67.0 - Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.67.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ghost installations running versions 4.0.0 through 6.66.x are affected. Exploitation requires an Administrator to import attacker-crafted content containing an SVG file.
Does an attacker need an existing Ghost account or administrative access?
No existing account or administrative privilege is stated as necessary. The attacker must convince an Administrator to import the crafted file, making user interaction a required part of exploitation.
What is the potential impact after a malicious SVG is imported?
The imported SVG can host scripts on the site's domain. This may allow compromise of staff users' Ghost admin sessions.
What version fixes the issue?
Upgrade Ghost to version 6.67.0, which fixes the unsanitized handling of SVG images in content imports.