Ghost CMS CVE-2026-70588

Exploitation requires Ghost administrator-level credentials (CVSS PR:H) and access to the Universal Import feature within Ghost Admin, which is enabled by default in the admin UI. The attacker must supply a crafted import payload containing XSS in the feature_image_caption field or a javascript: URI or attribute-injecting string within bookmark or link card url fields - these are specific fields in Ghost's JSON import format. Exploitation is bounded by the high-privilege requirement: unauthenticated users, registered members, and non-admin staff cannot access the Universal Import feature and cannot trigger this vulnerability. High attack complexity (CVSS AC:H) indicates that crafting a functional exploit requires specific knowledge of Ghost's import schema and the rendering pipeline. Victim interaction may be required for the XSS to execute in a user browser context, though the exact rendering path (admin modal vs. public post) determines whether a secondary victim must load the page.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L, score 5.0) reflects a moderate-severity finding requiring administrator privileges and high attack complexity. The PR:H constraint is the dominant risk limiter - an attacker must already hold or compromise a Ghost admin account, making this a near-insider-level threat. The UI:N assignment is atypical for stored XSS, which conventionally requires a victim to load the affected page (UI:R); the vector may reflect a rendering path where the admin panel surfaces the XSS on page load without explicit user action, but this warrants vendor clarification. No EPSS data was provided, so exploitation probability cannot be quantified against the broader threat population. KEV status is not confirmed and no public POC exists, making this a low-urgency issue for most organizations. The most realistic threat model is a malicious admin or a supply-chain-compromised admin session using the import feature to embed persistent XSS in published post content, affecting public site visitors - but this requires the attacker to have already achieved high-privilege access, significantly dampening real-world risk beyond the raw CVSS integrity score.

An attacker who holds or has compromised a Ghost administrator account crafts a Ghost export JSON file containing XSS payloads in the feature_image_caption field or in bookmark card link URLs, then imports it via the Universal Import feature in Ghost Admin. The unsanitized content is stored in the database and subsequently rendered - either in the post history modal visible to other admins or in published post HTML served to public site visitors - executing arbitrary JavaScript in the victim's browser session. No public proof-of-concept exploit is known at time of analysis.