CVE-2026-105644: Ghost Stored XSS Vulnerability via SVG Files in Content Imports
Summary
CVE-2026-105644: Ghost : Stored XSS via SVG Files in Content Imports. Affects ghost versions >= 4.0.0, < 6.67.0. Fixed in 6.67.0. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-105644 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It offers a user-friendly interface, robust features for content management, and supports various integrations. However, Ghost versions from 4.0.0 to 6.65.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of SVG files in content imports.
Vulnerability Detail
The vulnerability arises from the lack of sanitization for SVG images included in content imports. An attacker could exploit this by convincing an Administrator to import a maliciously crafted SVG file. This could lead to the execution of scripts on the site's domain, potentially compromising the admin sessions of staff users. The technical aspects involve the improper validation of file types and the execution of embedded scripts within SVG files, which are not adequately filtered before being stored.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.67.0
This is the first release that contains the fix.
npm install ghost@6.67.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid importing SVG files until the Ghost instance is updated to a patched version. Additionally, consider using alternative image formats that do not pose the same security risks.
Conclusion
In summary, the stored XSS vulnerability in Ghost due to improper handling of SVG files poses a significant risk to users. It is crucial to update to version 6.67.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in your software.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows an attacker to execute scripts on the site's domain, potentially compromising admin sessions of staff users.
Ghost versions from 4.0.0 up to 6.65.0 are vulnerable to this issue.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
Avoid importing SVG files and monitor for any suspicious activity on your site until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
