File Upload Vulnerability in Ghost CMS from TryGhost
CVE-2026-105679
7.3HIGH
What is CVE-2026-105679?
Ghost, a Node.js-based content management system, presents a vulnerability in versions 6.22.1 through 6.64.0, allowing unauthorized file types to be uploaded without proper content type validation. Specifically, files uploaded by staff users could be served with content types determined by file extensions rather than enforced restrictions. This flaw raises the risk of hosting malicious scripts on the site's domain, which could compromise the admin sessions of other staff users. The issue has been addressed in version 6.64.0, and users are strongly advised to update to this version to enhance security.
Affected Version(s)
Ghost >= 6.22.1, < 6.64.0