tryghost/ghost · Security
Ghost: Remote Code Execution via Theme Translation Files
- GHSA ID
- GHSA-jj74-hc2q-xrvm
- CVE ID
- CVE-2026-105677
- Severity
- high
- Published
- Updated
- CVSS
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
Impact
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.
Vulnerable versions
This vulnerability is present in Ghost from v6.10.3 up to v6.64.0.
Patches
v6.64.0 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks Miguel Segovia Gil of KPMG, Alemmi, and Tomer-PL for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at [email protected].
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
- CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-jj74-hc2q-xrvm ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-105677 ↗
- https://github.com/TryGhost/Ghost/issues/30635 ↗
- https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02 ↗
- https://github.com/TryGhost/Ghost/releases/tag/v6.64.0 ↗
- https://github.com/advisories/GHSA-jj74-hc2q-xrvm ↗