cyfenced.com →

[ CVE-2026-105677 · Published 5 Oct 2026 ]

Ghost: Remote Code Execution via Theme Translation Files

CVSS 7.2 EPSS <1%Fix available

[ Description ]Official description

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0.

[ Fixes ]Fixes and patches

  • ghost 6.64.0Fixed version · GitHub Advisories · npm package ghost: upgrade to 6.64.0 or later (affected >= 6.10.3, < 6.64.0)

[ Packages ]Affected open-source packages

[ References ]References