CVE-2026-105644: Tryghost Ghost

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0.

Affected products

• Tryghost Ghost: from 4.0.0, before 6.67.0 (fixed in 6.67.0)

Published 2026-10-05. Last modified 2026-10-06.