GitHub Advisoryadvisory · npm

GHSA-jj74-hc2q-xrvm Ghost: Remote Code Execution via Theme Translation Files

HIGH Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-105677
Ecosystem
npm
Packages
ghost
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-829, CWE-94
Reviewed
2026-10-07

Affected packages

• npm ghost: >= 6.10.3, < 6.64.0 → fixed in 6.64.0

Description

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Miguel Segovia Gil of KPMG, Alemmi, and Tomer-PL for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at [email protected].

Related

Alias · CVE (1)

  • CVE-2026-105677 Ghost is a Node.js content management system. vulnerability

Weakness · CWE (3)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness
  • CWE-94 Improper Control of Generation of Code weakness

References