CVE-2026-104418
Received Received - Intake

Authenticated Admin RCE via Malicious Theme Translation in Ghost

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104418
EUVD
EUVD-2026-91429

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ghost ghost to 6.64.0 (exc)
ghost ghost 6.64.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104418 is a high-severity remote code execution (RCE) vulnerability in Ghost CMS versions 6.10.3 to 6.64.0. It allows authenticated administrators to execute arbitrary code by uploading a malicious theme containing crafted translation files. The flaw stems from improper handling of theme translation files, enabling path traversal and code injection attacks.

Detection Guidance

To detect this vulnerability, check Ghost CMS versions between 6.10.3 and 6.64.0. Run: 'ghost version' to verify the installed version. Inspect theme directories for suspicious translation files or unauthorized uploads. Monitor server logs for unusual admin actions or file modifications.

Impact Analysis

If you are an administrator of a vulnerable Ghost instance, an attacker with admin access could exploit this to gain full control over your server. This could lead to data breaches, unauthorized modifications, or service disruption. Self-hosted users are particularly at risk if they do not update to version 6.64.0 or later.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations could face legal penalties, reputational damage, and loss of trust if sensitive data is compromised due to this flaw.

Mitigation Strategies

Upgrade Ghost to version 6.64.0 or later immediately. Remove any untrusted themes or translation files. Restrict admin access to trusted users only. Review server logs for signs of exploitation. Apply patches via Ghost-CLI or Docker as recommended.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104418. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart