Vulnerabilities

Ghost is a Node.js content management system.

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Node.js

Product

Node.js

CVSS

7.3

EPSS

0.003 (p23)

Fix

available

Exposure class

Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-105649 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 10
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 3.8 Fix available CVE-2026-105683 Node.js
2. 10
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 2.7 Fix available CVE-2026-105682 Node.js
3. 13
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 6.5 Fix available CVE-2026-105681 Node.js
4. 13
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 6.5 Fix available CVE-2026-105680 Node.js
5. 20
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 7.3 Fix available CVE-2026-105679 Node.js
6. 13
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 4.3 Fix available CVE-2026-105678 Node.js
7. 20
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 7.2 Fix available CVE-2026-105677 Node.js
8. 13
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 4.9 Fix available CVE-2026-105676 Node.js
9. 20
   CVE NVD 26d ago

   Ghost is a Node.js content management system.

   CVSS 7.5 Fix available CVE-2026-105675 Node.js
10. 10
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 3.1 Fix available CVE-2026-105652 Node.js
11. 20
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 7.3 Fix available CVE-2026-105651 Node.js
12. 20
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 8.1 Fix available CVE-2026-105650 Node.js
13. 13
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 4.0 Fix available CVE-2026-105648 Node.js
14. 13
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 4.0 Fix available CVE-2026-105647 Node.js
15. 13
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 4.9 Fix available CVE-2026-105646 Node.js
16. 13
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 4.9 Fix available CVE-2026-105645 Node.js
17. 13
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 6.8 Fix available CVE-2026-105644 Node.js
18. 20
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 7.3 Fix available CVE-2026-105643 Node.js
19. 20
    CVE NVD 26d ago

    Ghost is a Node.js content management system.

    CVSS 8.8 Fix available CVE-2026-105642 Node.js