What is the CVSS score of EUVD-2026-52978?

EUVD-2026-52978 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-52978?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52978. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-52978?

Yes, a patch is available for EUVD-2026-52978. Update the affected software to the latest version immediately.

Ghost Admin EUVD-2026-52978

| CVE-2026-70594 MEDIUM

Session Fixation (CWE-384)

2026-08-04 https://github.com/TryGhost/Ghost

GHSA-7mpp-r37j-x5wh

Information Disclosure Docker Session Fixation

6.7

CVSS 3.1 · Vendor: https://github.com/TryGhost/Ghost

Severity by source

Vendor (https://github.com/TryGhost/Ghost) PRIMARY

6.7 MEDIUM

AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

vuln.today AI

6.7 MEDIUM

AV:A and AC:H reflect the mandatory prerequisite same-domain vulnerability; UI:R required as victim must log in; PR:N since attacker is unauthenticated; C:H/I:H for full admin session takeover.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

4.0 AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/TryGhost/Ghost).

CVSS VectorVendor: https://github.com/TryGhost/Ghost

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 00:28 vuln.today

Analysis Generated

Aug 05, 2026 - 00:28 vuln.today

DescriptionCVE.org

Impact

Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted.

Vulnerable versions

This vulnerability is present in Ghost from v2.2.0 to v6.54.0.

Patches

v6.54.1 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

References

Ghost thanks meifukun for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).

AnalysisAI

Session fixation in Ghost Admin (v2.2.0-v6.54.0) allows an attacker who can plant a known session identifier in a victim's browser - via a secondary vulnerability on the same domain - to hijack an authenticated Ghost Admin session after the victim logs in. The root cause is that Ghost Admin's login flow did not call session regeneration, leaving the pre-login session ID valid post-authentication. Exploitation is chained and non-trivial, but the upstream fix (v6.54.1) is confirmed and straightforward to apply. No public exploit code and no CISA KEV listing identified at time of analysis.

Technical ContextAI

Ghost is a Node.js-based CMS distributed as an npm package (pkg:npm/ghost). The vulnerability exists in the session-service middleware at ghost/core/core/server/services/auth/session/session-service.js, which manages express-session lifecycles. CWE-384 (Session Fixation) occurs when an application accepts a user-supplied or pre-existing session token after authentication rather than issuing a fresh one. In Ghost's case, the createSessionForUser function reused the current req.session object without calling req.session.regenerate(), meaning any session ID established before login remained valid - and authenticated - after a successful login event. The fix introduces an explicit regenerate() call, carries forward only necessary non-sensitive session properties (MFA challenge data, prior user_id for verification state logic), and issues a new session ID to the client.

RemediationAI

Upgrade to Ghost v6.54.1 or later, which introduces session regeneration on login via req.session.regenerate() in session-service.js (patch commit 6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c, PR #29634). For Docker-based installs, update using the official Ghost image at https://hub.docker.com/_/ghost following instructions at https://docs.ghost.org/install/docker#updating-ghost. For Ghost-CLI installs, follow https://docs.ghost.org/update. If immediate upgrade is not possible, the most effective compensating control is to ensure Ghost Admin is hosted on an isolated domain with no user-controllable content - this eliminates the prerequisite same-domain vulnerability needed to plant a session ID. Additionally, enforcing strict Content Security Policy and eliminating any XSS vectors on the same origin reduces the attack surface to near zero without requiring the Ghost upgrade, though these measures do not address the root cause.