p PatchFirst

CVE-2026-104411

CVE-2026-104411 · Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.

CVSS 8.5 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • ≥ 6.22.1, < 6.64.0: Affected (semver)
    • 6.64.0: Not affected (semver)

    Update to 6.64.0

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 6.22.1, < 6.64.0

    Update to 6.64.0

Original sources

Check your server →