Ghost CMS CVE-2026-105677

Requires an authenticated Ghost Administrator (PR:H) who can install or upload a custom theme; exploitation works by abusing how Ghost loads a theme's translation (i18n) files, using a crafted theme to trigger path traversal into attacker-controlled code. Affected versions are 6.10.3 up to (but not including) 6.64.0 of Ghost (tryghost/ghost). Limiting factors: the Administrator role requirement sharply narrows the attacker population to trusted/compromised admin accounts; no end-user interaction is needed beyond the attacker's own admin actions; deployments that restrict theme uploads or run a single trusted admin face substantially reduced exposure.

This is a high-severity but access-gated issue, not a mass-exploitation priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) scores network reach and full CIA impact (arbitrary code execution), but the decisive limiter is PR:H - exploitation requires an authenticated Administrator, the highest-trust role in Ghost. An attacker who already holds Administrator can typically perform damaging actions anyway, so this primarily raises risk as a privilege-to-RCE escalation (moving from application-admin to OS-level code execution on the host) and as a post-compromise vector following credential theft or a rogue/over-privileged admin account. No EPSS score, KEV listing, or public POC was provided; exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - there is no network-vs-local or auth conflict to flag. Net assessment: patch promptly on multi-admin or managed-hosting Ghost deployments, but this is lower urgency than an unauthenticated RCE given the Administrator prerequisite.

An authenticated Ghost Administrator uploads or installs a crafted theme whose translation (i18n) files use path-traversal sequences to make Ghost load and execute an attacker-controlled file, yielding arbitrary code execution on the server (CWE-22). No public exploit code was identified in the provided data; exploitation requires Administrator privileges and the network-accessible admin interface (AV:N/AC:L).