CVE-2026-104411
Received Received - Intake

Stored XSS in Ghost CMS via Malicious File Upload

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104411
EUVD
EUVD-2026-91422

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tryghost ghost to 6.64.0 (exc)
tryghost ghost From 6.64.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104411 is a stored cross-site scripting (XSS) vulnerability in Ghost CMS versions 6.22.1 to 6.64.0. It allows authenticated staff users to upload malicious script-bearing files via the default local storage adapter. These files are served with extension-derived content types, enabling attackers to host scripts on the site's domain and compromise other staff users' admin sessions.

Detection Guidance

Check Ghost CMS version to see if it falls within the vulnerable range (6.22.1 to 6.63.x). Use commands like 'ghost version' or inspect package.json for version details. Monitor uploaded files for unexpected script-bearing extensions served with content types matching their extensions.

Impact Analysis

This vulnerability allows attackers to upload malicious scripts that can compromise other staff users' admin sessions. This could lead to unauthorized access, data theft, or further exploitation of the Ghost CMS platform. The high CVSS scores (7.3 v3.1, 8.5 v4.0) indicate significant risk of confidentiality and integrity breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compromised admin sessions may result in data breaches, non-compliance with security controls, and regulatory penalties.

Mitigation Strategies

Upgrade Ghost CMS to version 6.64.0 or later immediately. For Docker-based installations, update the image tag. For Ghost-CLI, run 'ghost update'. Remove or restrict uploads from untrusted staff users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104411. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart