Ghost CMS EUVD-2026-91425

Exploitation requires that a Ghost staff user embed an attacker-controlled URL whose server returns a crafted oEmbed photo response; the malicious script is only stored and executed through Ghost's oEmbed photo-embedding feature. The attacker needs no Ghost account or privileges (PR:N), but cannot self-trigger the flaw - a staff member with content-editing access must perform the embed (UI:P), which limits exploitation to targeted social engineering rather than unauthenticated remote automation. Exploitation is further bounded to Ghost instances running versions 2.5.0 up to (not including) 6.64.0.

This is a credible, above-average-priority issue but not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 8.6) indicates a network-reachable, low-complexity stored XSS requiring passive user interaction, with high confidentiality and integrity impact to the vulnerable system (VC:H/VI:H) and no subsequent-system (scope) impact (SC:N/SI:N/SA:N). The real risk driver is impact rather than ease: the payload persists and executes in the Ghost editor, the published site, and newsletter emails, so successful exploitation can compromise staff admin sessions. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so: no public exploit identified at time of analysis. The UI:P requirement is a meaningful brake - an attacker cannot trigger this unilaterally; a staff user must embed the attacker-hosted URL - which argues against mass, automated exploitation and favors targeted social-engineering of content editors. A vendor patch is available, which raises priority for defenders because the fix path is clear. Net: patch promptly given the admin-session impact, but treat widespread opportunistic exploitation as unlikely absent an EPSS/KEV signal.

An attacker stands up a web endpoint that returns a malicious oEmbed 'photo' response containing script. They socially engineer or trick a Ghost staff member into embedding that URL in a post; the untrusted script is stored and then executes in the editor, on the published site, and in newsletter emails, hijacking the staff admin session. No public exploit code is referenced, so: no public exploit identified at time of analysis.