[ Vendor · 54 CVEs ]
TryGhost
CVEs affecting TryGhost published in the last 30 days, plus any TryGhost CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105683 | 5 Oct 2026 | CVSS 3.8 | Ghost: Path Traversal Vulnerability in Ghost ImageSize ServiceGhost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files… | Fix |
| CVE-2026-105681 | 5 Oct 2026 | CVSS 6.5 | Ghost: Authorization Bypass in Comments FeatureGhost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not… | Fix |
| CVE-2026-105682 | 5 Oct 2026 | CVSS 2.7 | Ghost: Server-Side Request Forgery in Webhook TriggerGhost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe… | Fix |
| CVE-2026-105679 | 5 Oct 2026 | CVSS 7.3 | Ghost: Stored XSS via File Uploads on Local StorageGhost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent… | Fix |
| CVE-2026-105680 | 5 Oct 2026 | CVSS 6.5 | Ghost: Authorization Issue Allowed Author Role to Delete any PostGhost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not… | Fix |
| CVE-2026-105651 | 5 Oct 2026 | CVSS 7.3 | Ghost: Stored XSS via Bookmark Card ImagesGhost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from… | Fix |
| CVE-2026-105652 | 5 Oct 2026 | CVSS 3.1 | Ghost: Password Hash Ordering Disclosure in Ghost Admin APIGhost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other… | Fix |
| CVE-2026-105675 | 5 Oct 2026 | CVSS 7.5 | Ghost: Invite Token Disclosure in Ghost Admin APIGhost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the… | Fix |
| CVE-2026-105676 | 5 Oct 2026 | CVSS 4.9 | Ghost: Path Traversal via Locale SettingGhost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an… | Fix |
| CVE-2026-105677 | 5 Oct 2026 | CVSS 7.2 | Ghost: Remote Code Execution via Theme Translation FilesGhost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an… | Fix |
| CVE-2026-105678 | 5 Oct 2026 | CVSS 4.3 | Ghost: Editors Could Promote Staff Users to Their Own RoleGhost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own… | Fix |
| CVE-2026-105647 | 5 Oct 2026 | CVSS 4.0 | Ghost: Server-Side Request Forgery in Bookmark FetchingGhost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be… | Fix |
| CVE-2026-105648 | 5 Oct 2026 | CVSS 4.0 | Ghost: Private IP Filtering Bypass via IPv6 Transition AddressesGhost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be… | Fix |
| CVE-2026-105649 | 5 Oct 2026 | CVSS 7.3 | Ghost: Stored XSS via SVG Uploads Bypassing SanitizationGhost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension… | Fix |
| CVE-2026-105650 | 5 Oct 2026 | CVSS 8.1 | Ghost: Stored XSS via oEmbed Photo ResponsesGhost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted… | Fix |
| CVE-2026-105644 | 5 Oct 2026 | CVSS 6.8 | Ghost : Stored XSS via SVG Files in Content ImportsGhost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An… | Fix |
| CVE-2026-105645 | 5 Oct 2026 | CVSS 4.9 | Ghost: Regular Expression Denial of Service in External Media InlinerGhost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU… | Fix |
| CVE-2026-105646 | 5 Oct 2026 | CVSS 4.9 | Ghost: Regular Expression Denial of Service in Content ImportGhost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the… | Fix |
| CVE-2026-105642 | 5 Oct 2026 | CVSS 8.8 | Ghost: Remote Code Execution via Bookmark Card ImagesGhost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in… | Fix |
| CVE-2026-105643 | 5 Oct 2026 | CVSS 7.3 | Ghost: Stored XSS via Embed Card PreviewsGhost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against… | Fix |
| CVE-2026-104414 | 2 Oct 2026 | CVSS 8.1 | TryGhost GhostGhost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post… | |
| CVE-2026-104415 | 2 Oct 2026 | CVSS 3.1 | TryGhost GhostGhost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the… | |
| CVE-2026-104416 | 2 Oct 2026 | CVSS 7.5 | TryGhost GhostGhost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of… | |
| CVE-2026-104417 | 2 Oct 2026 | CVSS 4.9 | TryGhost GhostGhost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to… | |
| CVE-2026-104418 | 2 Oct 2026 | CVSS 7.2 | TryGhost GhostGhost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme… | |
| CVE-2026-104411 | 2 Oct 2026 | CVSS 7.3 | TryGhost GhostGhost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files… | |
| CVE-2026-104412 | 2 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own… | |
| CVE-2026-104413 | 2 Oct 2026 | CVSS 7.3 | TryGhost GhostGhost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host… | |
| CVE-2026-103287 | 1 Oct 2026 | CVSS 2.7 | TryGhost GhostGhost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe… | |
| CVE-2026-103288 | 1 Oct 2026 | CVSS 6.5 | TryGhost GhostGhost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An… | |
| CVE-2026-103289 | 1 Oct 2026 | CVSS 6.5 | TryGhost GhostGhost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they… | |
| CVE-2026-103290 | 1 Oct 2026 | CVSS 3.8 | TryGhost GhostGhost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation… | |
| CVE-2026-103291 | 1 Oct 2026 | CVSS 6.4 | TryGhost GhostGhost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated… | |
| CVE-2026-103292 | 1 Oct 2026 | CVSS 8.0 | TryGhost GhostGhost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}}… | |
| CVE-2026-103281 | 1 Oct 2026 | CVSS 5.4 | TryGhost GhostGhost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An… | |
| CVE-2026-103282 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be… | |
| CVE-2026-103283 | 1 Oct 2026 | CVSS 8.1 | TryGhost GhostGhost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user… | |
| CVE-2026-103284 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized… | |
| CVE-2026-103285 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers… | |
| CVE-2026-103286 | 1 Oct 2026 | CVSS 7.3 | TryGhost GhostGhost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff… | |
| CVE-2026-103275 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which… | |
| CVE-2026-103276 | 1 Oct 2026 | CVSS 5.3 | TryGhost GhostGhost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates… | |
| CVE-2026-103277 | 1 Oct 2026 | CVSS 8.1 | TryGhost GhostGhost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox… | |
| CVE-2026-103278 | 1 Oct 2026 | CVSS 7.3 | TryGhost GhostGhost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user… | |
| CVE-2026-103279 | 1 Oct 2026 | CVSS 6.8 | TryGhost GhostGhost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can… | |
| CVE-2026-103280 | 1 Oct 2026 | CVSS 5.3 | TryGhost GhostGhost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to… | |
| CVE-2026-103268 | 1 Oct 2026 | CVSS 8.8 | TryGhost GhostGhost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through… | |
| CVE-2026-103269 | 1 Oct 2026 | CVSS 5.3 | TryGhost GhostGhost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of… | |
| CVE-2026-103271 | 1 Oct 2026 | CVSS 7.5 | TryGhost GhostGhost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content… | |
| CVE-2026-103272 | 1 Oct 2026 | CVSS 7.5 | TryGhost GhostGhost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak… | |
| CVE-2026-103273 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass… | |
| CVE-2026-103274 | 1 Oct 2026 | CVSS 5.3 | TryGhost GhostGhost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments… | |
| CVE-2026-103266 | 1 Oct 2026 | CVSS 7.1 | TryGhost GhostGhost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a… | |
| CVE-2026-103267 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address… |