Ghost CMS CVE-2026-105679

Exploitation requires: (1) the site must use Ghost's DEFAULT local storage adapter - sites on S3 or other cloud adapters are not affected because those store and serve an inert content type; (2) the attacker must be an authenticated staff user with file-upload privileges; and (3) a victim staff/admin user must load the uploaded file's URL in their browser (UI:R). The attack is limited to the window of Ghost versions 6.22.1 through 6.63.x and is neutralized in 6.64.0, which forces an inert content type plus nosniff. The requirement for staff-level authentication and victim interaction is the primary limiting factor; this is not exploitable by unauthenticated or anonymous visitors.

This is a stored XSS flaw (CWE-79) in Ghost CMS carrying a vendor/NVD CVSS of 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). The network vector and low complexity are real, but two factors meaningfully constrain actual risk: PR:L means the attacker must already be an authenticated staff user, and UI:R means a second staff user must load the malicious file. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The signals are internally consistent - the CVSS vector matches the description (authenticated upload, victim interaction, confidentiality/integrity impact on admin sessions, no availability impact). Realistically this is a privilege-escalation/lateral-movement primitive among staff accounts rather than an unauthenticated internet-facing RCE: a genuine issue to patch, but closer to a mid-tier priority than an emergency given the authentication and interaction prerequisites. The one condition worth verifying is the storage adapter: the flaw only affects sites on the default local storage adapter (S3/cloud adapters already set an inert content type), so exposure depends on deployment configuration.

A malicious or compromised staff user on a Ghost site using the default local storage adapter uploads a crafted file (e.g. an HTML or JS payload) that Ghost serves with an executable content type derived from its extension. When another staff user - such as an administrator - visits the attacker-controlled URL on the site's own domain, the script executes in their browser context and can hijack their admin session. No public exploit code is identified at time of analysis, but the technique is straightforward for anyone with staff upload access.