Ghost CMS CVE-2026-105651

Requires an authenticated Ghost staff account of any level, explicitly including the lowest Contributor role (PR:L), on a version from 5.94.0 up to but not including 6.64.0. The attacker must use the bookmark-card creation feature and control an external website that returns non-image content (e.g. HTML) at the og:image/favicon URLs - Ghost pre-fix trusted the URL extension to set the stored file's Content-Type rather than validating file contents. Exploitation is LIMITED by: (1) needing a valid staff credential, (2) UI:R - a victim admin/staff user must subsequently load the post or editor containing the card for the stored HTML to execute, and (3) it is remediated in 6.64.0, which validates fetched bytes with the file-type library against the image-upload allowlist.

This is a moderately serious, authenticated stored-XSS issue (CWE-79) rather than a drive-by critical. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N = 7.3) correctly captures the key constraints: network-reachable but requiring low privileges (PR:L) and victim interaction (UI:R). The crucial real-world mitigator is the PR:L requirement - the attacker must already hold a valid staff account. The notable risk amplifier, confirmed by the description and commit, is that the LOWEST-privilege staff role (Contributor) can trigger it, so the trust boundary crossed (Contributor → Admin session takeover) is a genuine privilege-escalation path within the CMS. The attacker-controlled HTML is served from the site's OWN domain, which defeats same-origin protections and makes admin session/cookie theft realistic - I assess this warrants a scope change (S:C), which would push the score higher than the vendor's S:U-based 7.3. No EPSS score, KEV listing, or POC was supplied in the input; absence of these signals means there is no evidence of active exploitation or mass scanning, consistent with an auth-gated XSS that requires a multi-step social/interaction chain. Net: a real priority for any Ghost instance that grants Contributor accounts to semi-trusted authors, but lower urgency for single-operator or trusted-team blogs.

A malicious or compromised Contributor creates a bookmark card pointing at an attacker-controlled site whose og:image/favicon links return HTML (not a real image); Ghost fetches and stores that HTML as the card's icon/thumbnail under the site's own domain. When an Administrator later views the post or editor, the stored HTML executes as the site's origin and can hijack the admin's authenticated session. No public exploit was provided in the input, though the fix commit includes a test demonstrating the exact non-image-stored-as-image technique.