{"id":"EUVD-2026-91424","enisaUuid":"c7dc1a8f-dfda-3175-ac41-d63830919274","description":"Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users\u0027 admin sessions.","datePublished":"Oct 2, 2026, 11:37:57 AM","dateUpdated":"Oct 2, 2026, 4:08:58 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6\nhttps://www.vulncheck.com/advisories/ghost-5.94.0-before-6.64.0-stored-xss-via-bookmark-card-images\n","aliases":"CVE-2026-104413\nGHSA-5pj5-x6hq-mvq7\n","assigner":"VulnCheck","epss":0.26,"enisaIdProduct":[{"id":"3761a19f-1ae4-3126-9e23-14cd9a99a750","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.94.0 \u003c6.64.0"}],"enisaIdVendor":[{"id":"ed9900d1-6aff-3d71-8b69-3b1c7dc20461","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"04470d8b-07ce-346e-8363-948ddf9b3f0f","vulnerability":{"id":"CVE-2026-104413","description":"Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users\u0027 admin sessions.","datePublished":"Oct 2, 2026, 11:37:57 AM","dateUpdated":"Oct 2, 2026, 4:08:58 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6\nhttps://www.vulncheck.com/advisories/ghost-5.94.0-before-6.64.0-stored-xss-via-bookmark-card-images\n","enisa_id":"EUVD-2026-91424\n","assigner":"VulnCheck","epss":0.26,"dataProcessed":"Nov 8, 2026, 7:15:54 AM","vulnerabilityProduct":[{"id":"802895d9-3a33-34fd-a429-69e70ba8094f","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.94.0 \u003c6.64.0"}],"vulnerabilityVendor":[{"id":"ebb19eda-6d56-3f30-a344-9aabf961a48d","vendor":{"name":"TryGhost"}}]}},{"id":"5986db82-9060-326a-a2de-0054199e733e","vulnerability":{"id":"GHSA-5pj5-x6hq-mvq7","description":"Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users\u0027 admin sessions.","datePublished":"Oct 2, 2026, 12:31:13 PM","dateUpdated":"Oct 2, 2026, 12:31:13 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104413\nhttps://www.vulncheck.com/advisories/ghost-5.94.0-before-6.64.0-stored-xss-via-bookmark-card-images\n","enisa_id":"EUVD-2026-91424\n","aliases":"CVE-2026-104413\nGHSA-5pj5-x6hq-mvq7\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}