Ghost CMS CVE-2026-105645

Requires an authenticated Ghost Administrator account (CVSS PR:H) to send a crafted request to the external media inliner feature; the vulnerable code path is the inliner's URL-matching logic that builds unescaped RegExp patterns from domain/directory strings. Exploitation is limited by the Administrator privilege requirement - a non-admin user, anonymous visitor, or default read-only front-end request cannot reach the vulnerable path - so realistic risk is confined to malicious administrators or attackers who have already compromised admin credentials. Affected only on versions 5.37.0 through 6.66.x; 6.67.0 and later are patched.

This is a genuine but low-priority denial-of-service issue (CWE-1333, inefficient regular expression complexity / ReDoS) rather than a high-impact flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) scores 4.9 Medium, and the single most important mitigating signal is PR:H: exploitation requires existing Administrator access, as stated explicitly in the description. There is no confidentiality or integrity impact (C:N/I:N) - only availability (A:H) via CPU exhaustion of the Node.js event loop. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The source-code evidence corroborates the description: the fix (commit 88ae6d6) adds lodash _.escapeRegExp() around directory names used to build RegExp objects and wraps the external media inliner's matchAll() in a V8 vm execution timeout, confirming catastrophic regex backtracking as the root cause. Net assessment: a real defect worth patching, but the admin-only precondition means this is a self-inflicted or insider/compromised-admin risk, not an internet-facing mass-exploitation threat.

An authenticated Ghost Administrator (or an attacker who has already compromised an admin account) sends a crafted request to the external media inliner containing input that triggers catastrophic regex backtracking. The matchAll() operation consumes excessive CPU, blocking the Node.js event loop and rendering the Ghost server unresponsive to all users. No public proof-of-concept was provided in the input, and the network attack vector is gated entirely by the required Administrator privilege.