Ghost CMS CVE-2026-105646

Requires an authenticated Ghost Administrator (CVSS PR:H) who can submit a content import file through Ghost's import feature; the attacker crafts file/directory path names so that the importer's path-prefix regex (built via unescaped new RegExp('^' + dir + '/') in the image, markdown, revue, and content-file import handlers) suffers catastrophic backtracking. The decisive limiting factor is the Administrator privilege requirement - this is not reachable by anonymous or low-privileged users, and no end-user interaction is involved. Affects Ghost versions 4.0.0 up to (but not including) 6.67.0; upgrading to 6.67.0 remediates it by escaping directory names with lodash _.escapeRegExp and bounding the media-inliner matcher with a V8 execution timeout.

This is a genuinely low-to-moderate priority issue despite being a server-availability flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9 Medium) is the most important signal: exploitation requires PR:H - Administrator access to the Ghost instance - which is confirmed by both the vector and the description ('Exploiting this requires Administrator access'). An attacker who is already a full administrator can typically disrupt the service through many legitimate means, so the marginal risk added by this CWE-1333 (inefficient regular expression / ReDoS) denial-of-service is limited. Impact is availability-only (C:N/I:N); there is no code execution, data exposure, or integrity loss. No EPSS score was supplied, and there is no CISA KEV listing and no public exploit code referenced - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The signals are internally consistent (no conflicts between vector and description), so the main caveat is simply that the high-privilege precondition makes this far less urgent than the network attack vector alone might suggest.

A malicious or compromised Ghost administrator uploads a crafted content import archive in which directory/path names are constructed to trigger catastrophic regex backtracking in the importer's path-matching handlers. Processing the import pins the Node.js event loop at high CPU, rendering the Ghost server unresponsive to all users until the process is restarted. No public exploit code was identified, but the fixing PR (#31058) reveals the vulnerable unescaped new RegExp('^' + dir + '/') pattern, making the mechanism straightforward to reconstruct.