CVE-2026-103290

Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103282

Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create duplicate user accounts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103278

Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through improper input validation.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103274

Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103269

Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103289

Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103288

Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103284

Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without proper authorization checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103280

Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103277

Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103276

Ghost before 6.20.0 File Read via URL Encoding Bypass

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103273

Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103268

Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and restore their original privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-103292

Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to compromise of a staff user's admin session when that user views the affected page.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-25552

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxy_add_x_forwarded_for directive to present an arbitrary IP address, circumventing Ghost's rate-limiting mechanisms on self-hosted instances.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost Tryghost

Products

Ghost Ghost-cli

CVE-2026-72596

Ghost Foundation Ghost - Broken Access Control

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to fall through and permit the deletion. An attacker with an Author account can delete any post on the platform.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-70595

Ghost: Server-Side Request Forgery Mitigation Issue

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-70596

Ghost: Cross-Site Scripting in Feature Image Captions

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-70588

Ghost: Cross-Site Scripting in Universal Import

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-70590

Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost