Ghost CMS CVE-2026-105643

Exploitation requires an authenticated Ghost staff account of any role - explicitly including the low-trust Contributor role - to author a post containing a malicious embed card that bypasses the editor's stored-XSS protections. The payload only executes when a second staff user opens the affected post in the Ghost admin editor (UI:R), so a higher-privileged victim's interaction is a hard prerequisite; it does not fire against anonymous front-end readers. Exploitation is therefore limited to sites that provision staff/Contributor accounts to semi-trusted or untrusted users, and self-hosted deployments are further protected by leaving the new security.embedPreviewUrl configuration option at its default value.

This is a moderate-priority, authenticated stored XSS (CWE-79) affecting Ghost 6.34.0-6.66.x, with a vendor CVSS 3.1 score of 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). The signals are internally consistent but point to a privilege-escalation-via-session-compromise threat rather than a mass-exploitation threat: AV:N/AC:L make delivery easy, but PR:L means the attacker must already be an authenticated staff user (even a low-trust Contributor), and UI:R means a second, higher-privileged staff user must open the malicious post in the editor for the payload to fire. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The realistic risk is an insider or a compromised low-tier account escalating to a full admin session (C:H/I:H), which is serious for multi-author publications but limited by the need for both staff-level access and victim interaction. Note the signal gap: because EPSS and KEV are absent (not negative), exploitation likelihood cannot be quantified from the input - treat this as a prioritized patch for sites with untrusted Contributors rather than an emergency internet-facing fix.

A Ghost publication grants Contributor accounts to freelance or guest writers. One such Contributor creates a post containing an embed card whose payload bypasses the editor's stored-XSS protections; when an Editor or Administrator opens that post in the Ghost admin editor to review it, the script executes in their browser and can hijack their authenticated admin session. No public exploit code was identified at time of analysis, but the attack is low-complexity for anyone holding a staff account.