CVE-2026-105646

MEDIUM 4.9

Ghost: Regular Expression Denial of Service in Content Import

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.

CWE	CWE-1333
Vendor	tryghost
Product	ghost
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for tryghost ghost

Be the first to know when new medium vulnerabilities affecting tryghost ghost are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

TryGhost / Ghost

>= 4.0.0, < 6.67.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/TryGhost/Ghost/security/advisories/GHSA-fwh9-qg68-vxp4 github.com: https://github.com/TryGhost/Ghost/pull/31058 github.com: https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce github.com: https://github.com/TryGhost/Ghost/releases/tag/v6.66.0