Ghost CMS EUVD-2026-91422

Requires an authenticated Ghost staff account (PR:L) on an instance running the default local storage adapter, which serves uploaded files with extension-derived content types from the site's own origin. Exploitation further requires a second staff user (typically higher-privileged) to view the malicious upload within the admin context (UI:P). Limiting factors: the attacker must already possess staff credentials, the instance must use default local storage (object-storage/CDN adapters on a separate origin mitigate it), and successful session compromise depends on a victim staff user loading the payload - so single-operator or non-default-storage deployments face substantially reduced real-world risk.

This is a credible but privilege-gated threat rather than a drive-by critical. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H) scores 8.5 (High) and is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated staff account (PR:L) and passive victim interaction (UI:P). The real-world risk is bounded by the PR:L prerequisite - an attacker must already hold a staff/author account, so this is primarily a privilege-escalation/lateral-movement primitive among staff (a lower-privileged author compromising an owner/admin session) rather than an unauthenticated internet-facing RCE. Exploitation signals are weak-to-absent: there is no CISA KEV listing and no public POC referenced, so this is not confirmed exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be stated - this is a notable data gap. A further limiter is that the flaw only manifests on the default local storage adapter; deployments fronting uploads with an object-storage/CDN adapter on a separate origin are not affected in the same way. Net: a real priority for multi-author Ghost instances where staff accounts are loosely trusted or self-registration is broad, but materially lower urgency than the 8.5 implies for single-admin or tightly-controlled installations.

A low-privileged staff user (e.g., an author) uploads a file whose extension causes Ghost's default local storage adapter to serve it with a script-executable content type on the site's own domain. When a higher-privileged staff user (owner/admin) later views that content in the admin context, the attacker's script runs in their authenticated session and hijacks it. No public exploit code is identified at time of analysis, but the technique is straightforward given a staff account.