Ghost CMS CVE-2026-105649

Requires an authenticated Ghost staff account; the advisory confirms even the lowest-trust Contributor role is sufficient (PR:L). The attacker uploads an SVG payload via one of two paths shown in the fix: (1) an SVG supplied as a video/media thumbnail, or (2) a file carrying a non-SVG extension (e.g. .png) together with a Content-Type of image/svg+xml, which the pre-patch allowlist checked only by extension. The second path's real-world impact depends on the configured storage adapter - adapters that serve files by stored content type (e.g. Amazon S3) will deliver the file as image/svg+xml and execute it, so exposure varies by storage backend. Exploitation is further limited by the need for a higher-privileged staff/admin user to actually view the malicious media (UI:R) for session compromise to occur; it does not fire automatically or against anonymous visitors. Instances that do not provision untrusted Contributor/Author accounts are effectively not exposed.

This is a stored XSS (CWE-79) in Ghost's media/image upload pipeline, vendor-rated 7.3. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N shows a network-reachable, low-complexity flaw, but two signals temper the raw score: PR:L means the attacker must already hold a staff account (the advisory specifies even a low-trust Contributor qualifies), and UI:R means a second, higher-privileged staff/admin user must actually view the malicious SVG before the payload fires. No EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is a privilege-escalation path: a semi-trusted Contributor can plant script that runs on the site's own domain to steal an admin's authenticated session. This is a genuine, real-world-plausible low-trust-account/insider threat for any Ghost instance that grants Contributor or Author accounts to untrusted parties, but it is not an unauthenticated internet-wide mass-exploitation issue - it is gated behind an existing account plus victim interaction, so it sits below the 'drop everything' tier while still warranting prompt patching. The source-code evidence clarifies a second trigger path (non-SVG extension with an image/svg+xml content type) that is most impactful on storage adapters serving by content type, e.g. S3 - verify your storage backend to judge exposure.

A user with a low-privilege Ghost Contributor account uploads an SVG containing an embedded <script> tag, either as a media thumbnail or as a file with a non-SVG extension (e.g. .png) and an image/svg+xml content type, bypassing sanitization. When an Administrator later previews that media in the Ghost admin, the script executes on the site's own domain in the admin's authenticated context and can hijack the admin session. No public proof-of-concept is identified in the provided data, and exploitation requires both an existing staff account and victim interaction.