CVE-2026-105649: Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-79

Description

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.

Affected products

TryGhost Ghost: from 4.22.0, < 6.65.0

References

https://github.com/TryGhost/Ghost/commit/80686226d23df56749f6b7ebb484850a8eba8072
https://github.com/TryGhost/Ghost/issues/30919
https://github.com/TryGhost/Ghost/releases/tag/v6.65.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-8575-cr6v-7jh4

Get alerted when CVE-2026-105649 or the next vulnerability affects your stack