CVE-2026-104418: Tryghost Ghost

High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days.

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.

Affected products

• Tryghost Ghost: from 6.10.3, before 6.64.0 (fixed in 6.64.0)

Published 2026-10-02. Last modified 2026-10-02.