{"id":"EUVD-2026-92633","enisaUuid":"f71bcecd-61c2-3716-a0c3-085c6c00bf00","description":"Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site\u0027s domain, possibly resulting in compromise of staff users\u0027 admin sessions. This issue is fixed in version 6.67.0.","datePublished":"Oct 5, 2026, 6:53:08 PM","dateUpdated":"Oct 6, 2026, 2:52:36 PM","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-hqq2-xqr2-fmx2\nhttps://github.com/TryGhost/Ghost/pull/31060\nhttps://github.com/TryGhost/Ghost/commit/1be06f4e95a5eb159d14abda7660e689af13cff1\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","aliases":"CVE-2026-105644\nGHSA-hqq2-xqr2-fmx2\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"a2857d5c-fc74-345d-bf77-1366a747c95e","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"4.0.0, \u003c 6.67.0"}],"enisaIdVendor":[{"id":"cbdcedd4-3e7f-34b8-bcd0-a803683461aa","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"251a7a16-65c6-31d4-8bc4-b2e1e01053b5","vulnerability":{"id":"GHSA-hqq2-xqr2-fmx2","description":"Ghost : Stored XSS via SVG Files in Content Imports","datePublished":"Oct 7, 2026, 8:43:03 PM","dateUpdated":"Oct 7, 2026, 8:43:03 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-hqq2-xqr2-fmx2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105644\nhttps://github.com/TryGhost/Ghost/pull/31060\nhttps://github.com/TryGhost/Ghost/commit/1be06f4e95a5eb159d14abda7660e689af13cff1\nhttps://github.com/TryGhost/Ghost\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","enisa_id":"EUVD-2026-92633\n","aliases":"CVE-2026-105644\nGHSA-hqq2-xqr2-fmx2\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f5b3373c-b26b-3437-83e4-5100ac73c3b2","vulnerability":{"id":"CVE-2026-105644","description":"Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site\u0027s domain, possibly resulting in compromise of staff users\u0027 admin sessions. This issue is fixed in version 6.67.0.","datePublished":"Oct 5, 2026, 6:53:08 PM","dateUpdated":"Oct 6, 2026, 2:52:36 PM","status":"PUBLISHED","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-hqq2-xqr2-fmx2\nhttps://github.com/TryGhost/Ghost/pull/31060\nhttps://github.com/TryGhost/Ghost/commit/1be06f4e95a5eb159d14abda7660e689af13cff1\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","enisa_id":"EUVD-2026-92633\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 8, 2026, 7:16:13 AM","vulnerabilityProduct":[{"id":"516933f7-b32c-3ffa-b3d9-ed032916335e","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"4.0.0, \u003c 6.67.0"}],"vulnerabilityVendor":[{"id":"2ee5ca01-f55c-311a-a306-5852bc7a3ca5","vendor":{"name":"TryGhost"}}]}}],"enisaIdAdvisory":[]}