CVE-2026-104418: Ghost Remote Code Execution via Theme Translation Files
Summary
CVE-2026-104418: Ghost: Remote Code Execution via Theme Translation Files. Affects ghost versions >= 6.10.3, < 6.64.0. Fixed in 6.64.0. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2026-104418 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghost is a popular open-source Node.js content management system designed for professional publishing. It allows users to create and manage blogs and websites with ease, featuring a user-friendly interface and a variety of themes and plugins. However, from versions 6.10.3 to 6.64.0, Ghost had a critical vulnerability that could be exploited by authenticated administrators.
Vulnerability Detail
The vulnerability arises from the way Ghost loads theme translation files. An authenticated Administrator could craft a malicious theme that, when loaded, allows the execution of arbitrary code on the server. This could lead to severe consequences, including unauthorized access to sensitive data, server compromise, and potential control over the entire application environment.
How To Fix
Minimum fixed version
6.64.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict access to the Ghost admin panel to trusted users only, thereby minimizing the risk of exploitation until the package can be updated.
Conclusion
The vulnerability identified as CVE-2026-104418 in Ghost poses a significant risk by allowing remote code execution through theme translation files. It is crucial for users to update to version 6.64.0 or later to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows authenticated administrators to execute arbitrary code on the server, which can lead to data breaches and server control.
You can check your Ghost version by running 'ghost version' in your terminal. If it is between 6.10.3 and 6.64.0, it is affected.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate updating is not possible, restrict access to the admin panel to trusted users and monitor for any suspicious activity.
Detailed information can be found in the vulnerability database at https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-105677.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
