Ghost: Remote code execution via theme translation files
Summary
Ghost versions 6.10.3 up to but not including 6.64.0 contain a remote code execution vulnerability in how theme translation files are loaded. An authenticated administrator can upload a crafted theme with malicious translation files and execute arbitrary code on the Ghost server. The attack requires administrator privileges, so the risk is mainly a compromised or malicious admin account.
Affected
- Ghost (npm package ghost) from 6.10.3 before 6.64.0
- Also tracked as CVE-2026-105677 (same GitHub advisory)
Fixed in
- Ghost 6.64.0
Workaround
Unknown. No workaround is documented in the sources reviewed; upgrading is the remedy.
Exploitation
- No evidence of exploitation in the wild found in the sources reviewed.
- No public proof of concept found in the sources reviewed.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update Ghost to version 6.64.0 or later, including Docker and Ghost-CLI installations.
- Limit the Administrator and Owner roles to the smallest number of trusted people and enforce MFA on admin logins.
- Only upload themes from trusted sources and review them before installation.
- Check Ghost admin logins for unexpected access and monitor for unusual theme changes.
- Track both CVE-2026-104418 and CVE-2026-105677.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-jj74-hc2q-xrvm github.com
- VulnCheck Advisory www.vulncheck.com
- OSV CVE-2026-104418 osv.dev
- VulDB CVE-2026-105677 vuldb.com
- GitLab Advisory CVE-2026-105677 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:25.
Original description (NVD)
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.