Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-105649US | — | — | ||
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization.… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/TryGhost/Ghost/commit/80686226d23df56749f6b7ebb484850a8eba8072WEB
- https://github.com/TryGhost/Ghost/issues/30919WEB
- https://github.com/TryGhost/Ghost/releases/tag/v6.65.0WEB
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-8575-cr6v-7jh4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-105649WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan