Ghost: Staff account takeover via input validation in admin iframe
Summary
Ghost versions 5.8.0 up to 6.34.0 (excluding 6.34.0) contain an input validation flaw in the admin iframe. An attacker with content publishing privileges can craft a malicious page that takes over the account of a staff user who visits it while logged in. Exploitation requires an authenticated author and an active staff user, and the vendor rates the impact as high for confidentiality and integrity.
Affected
- Ghost 5.8.0 up to, but not including, 6.34.0
- Self-hosted instances (Docker, Ghost-CLI or other installations)
Fixed in
- Ghost 6.34.0 (per the affected range in the vendor advisory)
- Latest stable 6.x release recommended, as later releases also contain fixes
Workaround
Unknown. No vendor workaround found; upgrading is the recommended action.
Exploitation
- No evidence of exploitation in the wild found
- No public proof of concept found
- CISA SSVC: exploitation none, automatable no, technical impact total
- NVD status: Deferred
Our recommendation
- Inventory all self-hosted Ghost instances and their versions
- Upgrade to the latest stable 6.x release
- Limit author and contributor roles and review who can publish content
- Enforce MFA for staff accounts
- Review recent staff logins and new users for signs of compromise
- Ghost(Pro) customers: confirm the hosted instance is updated by the vendor
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5pxf-whwv-g54g github.com
- VulnCheck advisory: Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe www.vulncheck.com
- OSV record CVE-2026-103278 osv.dev
- Strix CVE record CVE-2026-103278 www.strix.ai
- ThreatInt CVE record CVE-2026-103278 cve.threatint.com
- Ghost 6.34.0 release notes newreleases.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:40.
Original description (NVD)
Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through improper input validation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.