CVE-2026-104413
Received Received - Intake

Stored XSS in Ghost CMS via Bookmark Card Image Fetching

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104413
EUVD
EUVD-2026-91424

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tryghost ghost From 5.94.0 (inc) to 6.64.0 (exc)
tryghost ghost From 5.94.0 (inc) to 6.63.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Ghost CMS versions 5.94.0 to 6.64.0. Staff users, including Contributors, can create bookmark cards that fetch non-image files from external sites as icons or thumbnails. These files may contain malicious HTML, allowing attackers to compromise other staff users' admin sessions.

Detection Guidance

To detect this vulnerability, check if your Ghost CMS version is between 5.94.0 and 6.63.0. Run the command: ghost version. If the version falls within this range, the system is vulnerable. Additionally, inspect bookmark cards for non-image files stored as icons or thumbnails, which may indicate exploitation.

Impact Analysis

Attackers could steal session cookies, perform actions on behalf of staff users, or inject malicious scripts into the admin interface. This could lead to unauthorized access, data theft, or further compromise of the Ghost instance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with privacy regulations, and potential legal consequences.

Mitigation Strategies

Immediately update Ghost CMS to version 6.64.0 or later using Docker or Ghost-CLI. If updating is not possible, restrict staff user permissions to prevent Contributors from creating bookmark cards. Monitor admin sessions for unusual activity and remove any suspicious bookmark cards.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104413. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart