Ghost: Stored cross-site scripting via local storage file uploads
Summary
Ghost, a Node.js content management system, contains a stored cross-site scripting vulnerability in its file upload handling. On sites using the default local storage adapter, uploaded files are served with a content type derived from their file extension, so a staff user can host scripts on the site's domain. An attacker with a staff account can use this to compromise the admin sessions of other staff users.
Affected
- Ghost from 6.22.1 up to 6.64.0 (affected range: >= 6.22.1, < 6.64.0)
- Sites using the default local storage adapter
Fixed in
- Ghost 6.64.0
Workaround
- No vendor workaround documented. Upgrading to 6.64.0 is the fix.
- Stopgap until patched (not from the vendor): disable or restrict local storage file uploads for staff and enforce strict MIME validation.
Exploitation
- No evidence of exploitation in the wild found. CISA SSVC: exploitation none, automatable no.
- No public proof of concept found; this does not prove that none exists.
Our recommendation
- Update self-hosted Ghost instances on 6.22.1 to 6.64.0 without delay. This also covers CVE-2026-104413 (bookmark card images).
- Until patched, limit staff invitations and review existing staff accounts.
- Check uploaded files for script-bearing content and confirm which storage adapter is in use.
- Ghost(Pro) customers: confirm with the provider that the patch is applied (not verified).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gfjp-2p8f-94qv github.com
- VulnCheck advisory: Ghost 6.22.1 before 6.64.0 Stored XSS www.vulncheck.com
- OSV: GHSA-gfjp-2p8f-94qv osv.dev
- GitLab Advisory Database: Ghost CVE-2026-105679 advisories.gitlab.com
- Vulners: CVE-2026-104411 vulners.com
- GitHub Security page for TryGhost/Ghost github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:34.
Original description (NVD)
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.