CVE-2026-70596: Ghost: Cross-Site Scripting in Feature Image Captions
Impact
An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation.
Vulnerable versions
This vulnerability is present in Ghost from v4.9.0 up to v6.54.0.
Patches
v6.54.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks Versa for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Other sources
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.54.1 - Upgrade
Upgrade
ghostto a version that resolves this vulnerability.Fixed in 6.54.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70596?
The severity of CVE-2026-70596 is rated as medium with a score of 4.3.
What does CVE-2026-70596 affect?
CVE-2026-70596 affects Ghost versions from v4.9.0 up to v6.54.0.
How do I fix CVE-2026-70596?
To fix CVE-2026-70596, upgrade to the patched version of Ghost provided in the software updates.
What kind of attack is CVE-2026-70596 associated with?
CVE-2026-70596 is associated with an input validation vulnerability that can lead to privilege escalation.
Can CVE-2026-70596 be exploited by any user?
Yes, the vulnerability can be exploited by any staff user to hijack another staff user's Ghost Admin session.