CVE-2026-105644: Ghost : Stored XSS via SVG Files in Content Imports
SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site’s domain, possibly resulting in compromise of staff users’ admin sessions.
References
- github.com/TryGhost/Ghost/commit/1be06f4e95a5eb159d14abda7660e689af13cff1
- github.com/TryGhost/Ghost/pull/31060
- github.com/TryGhost/Ghost/releases/tag/v6.66.0
- github.com/TryGhost/Ghost/security/advisories/GHSA-hqq2-xqr2-fmx2
- github.com/advisories/GHSA-hqq2-xqr2-fmx2
- nvd.nist.gov/vuln/detail/CVE-2026-105644
Code Behaviors & Features
Detect and mitigate CVE-2026-105644 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →