Stored XSS in Ghost via File Uploads

hello@craftedsignal.io — Wed, 07 Oct 2026 22:50:47 +0000

Ghost, a widely used content management system, contains a security vulnerability (CVE-2026-105679) within its local storage adapter. In affected versions (6.22.1 up to 6.64.0), the application fails to enforce restrictive Content-Type headers when serving uploaded files. Under normal security configurations, platforms serve user-uploaded content with restrictive types to prevent execution. Due to this flaw, files uploaded by staff users are served based on their file extension, enabling an attacker with staff-level privileges to host malicious scripts directly on the application's domain. Successful exploitation allows for the execution of arbitrary JavaScript in the context of other staff users, potentially leading to session hijacking, administrative account compromise, and unauthorized administrative actions within the Ghost instance. Defenders should identify instances running versions within the affected range and prioritize upgrades to v6.64.0 or higher.

Impact

Successful exploitation results in stored cross-site scripting (XSS), which allows an attacker to compromise administrative sessions of staff users. This impacts the integrity and availability of the Ghost instance by enabling malicious actors to perform administrative tasks, modify site content, or extract sensitive session information. This is particularly critical in environments where multiple staff members collaborate on content publishing.

Recommendation

Upgrade all self-hosted Ghost instances to version 6.64.0 or later to patch CVE-2026-105679.
For Docker-based deployments, pull the latest official Ghost image and follow the standard container update procedures.
Review administrative staff access logs for suspicious file upload patterns or unusual activity involving the site storage directory.
If immediate patching is not possible, restrict file upload permissions for non-trusted staff accounts until the environment is updated.

Unauthenticated Stripe Checkout Manipulation in Ghost

hello@craftedsignal.io — Thu, 01 Oct 2026 12:42:24 +0000

Ghost versions 5.2.0 through 6.61.9 are susceptible to an unauthenticated vulnerability within the Stripe Checkout integration. An attacker can exploit this flaw to force an arbitrary paid subscription onto an existing member's account. This process allows the attacker to manipulate the member's profile, specifically the name field. Furthermore, the vulnerability enables the injection of malicious content, which is subsequently embedded into newsletters generated and distributed by the platform to the affected member. Depending on the email client's handling of the injected HTML, this can lead to successful HTML injection or Cross-Site Scripting (XSS) attacks. Defenders should prioritize patching, as this vulnerability allows for unauthorized modification of member data and potential delivery of malicious payloads via trusted communication channels.

Impact

The vulnerability poses a significant risk to the integrity of member databases and the security of end-user communications. Successful exploitation allows attackers to associate paid subscriptions with arbitrary users and deliver malicious scripts directly to user email inboxes. This can lead to account takeover, theft of user credentials, or malicious redirects when victims interact with the injected content within the newsletter.

Recommendation

Upgrade all instances of Ghost to version 6.62.0 or later to remediate CVE-2026-103266.
Audit recent member subscription history and newsletter delivery logs for anomalies associated with unauthorized Stripe checkout activity.
Implement stricter input validation on member profile name fields to mitigate the potential impact of HTML and script injection during the patching window.

Cpe:2.3:a:ghost:ghost:*:*:*:*:*:*:*:* - CraftedSignal Threat Feed

Stored XSS in Ghost via File Uploads

Impact

Recommendation

Unauthenticated Stripe Checkout Manipulation in Ghost

Impact

Recommendation

Cpe:2.3:a:ghost:ghost:::::::: - CraftedSignal Threat Feed