CVE-2026-105644

MEDIUM 6.8

Ghost: Stored XSS via SVG Files in Content Imports

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0.

CWE	CWE-79 CWE-434
Vendor	tryghost
Product	ghost
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for tryghost ghost

Be the first to know when new medium vulnerabilities affecting tryghost ghost are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

TryGhost / Ghost

>= 4.0.0, < 6.67.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/TryGhost/Ghost/security/advisories/GHSA-hqq2-xqr2-fmx2 github.com: https://github.com/TryGhost/Ghost/pull/31060 github.com: https://github.com/TryGhost/Ghost/commit/1be06f4e95a5eb159d14abda7660e689af13cff1 github.com: https://github.com/TryGhost/Ghost/releases/tag/v6.66.0