Ghost CMS CVE-2026-104418

Requires an authenticated Ghost administrator account (PR:H) with access to theme upload/management functionality - exploitation is not possible for anonymous, member, author, or editor roles. The specific trigger is Ghost's theme translation (i18n/locale) file loading mechanism: the attacker must be able to upload a custom theme containing crafted translation files that abuse path traversal (CWE-22). Limiting factors: full administrator privileges are mandatory, the theme-upload feature must be reachable, and only Ghost versions 6.10.3 up to (not including) 6.64.0 are affected; patched instances (6.64.0+) are not exploitable. No end-user interaction is required (UI:N) once admin access is held.

This is a genuine but access-gated risk rather than a drive-by threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the description agree cleanly: exploitation is network-reachable and low-complexity, but requires full administrator privileges (PR:H), which is the single biggest limiting factor. Impact is severe once the condition is met - full compromise of the Ghost host (VC:H/VI:H/VA:H), consistent with the stated remote code execution and CWE-22 path traversal in theme translation file loading. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automatable mass-scanning at this time; the discovery credit to VulnCheck and the published GHSA advisory indicate coordinated disclosure rather than observed in-the-wild abuse. Net: a vendor-confirmed, patched, high-impact flaw whose real-world priority is driven almost entirely by whether an attacker can reach an authenticated admin session - treat as high priority for internet-exposed Ghost admin panels and multi-admin tenancies, lower for single-trusted-operator deployments. The CVSS vector and description are mutually consistent; no conflicting signals were detected.

An attacker who has obtained Ghost administrator credentials (via phishing, credential reuse, or a compromised staff account) logs into the admin panel and uploads a crafted theme whose translation files abuse path traversal during loading, causing arbitrary code execution on the underlying server. No public exploit code was identified in the provided data, and low attack complexity (AC:L) means a knowledgeable attacker with admin access can reliably trigger it.