SQL Injection Vulnerability in Ghost Content Management System
CVE-2026-105649

7.3HIGH

Key Information:

Vendor

Tryghost

Status
Ghost
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105649?

The Ghost content management system has a vulnerability that affects versions from 4.22.0 to 6.64.0. It allows staff users, including Contributors, to upload SVG media thumbnails without proper sanitization when using a non-SVG file extension. This oversight enables the possibility of hosting malicious scripts on the website, which could compromise the admin sessions of other staff users. The issue has been resolved in version 6.65.0, so it is advised to update to this version to mitigate potential risks.

Affected Version(s)

Ghost >= 4.22.0, < 6.65.0

References

https://github.com/TryGhost/Ghost/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/TryGhost/Ghost/issues/30919
x_refsource_MISC
https://github.com/TryGhost/Ghost/commit/80686226d23df567...
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.