ghost@4.36.2

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the selectedRevision path in the post history modal and feature image caption rendering code. An attacker can execute script in another staff user’s Admin session by creating or editing a post with a crafted feature_image_caption that is later viewed in post revision history or context rendering. When Ghost Admin renders the revision preview, the caption is treated as HTML without sanitization, so attacker-controlled markup is preserved and displayed to staff users. This can hijack an admin session and let the attacker act with the victim’s privileges.

Notes

• The vulnerable rendering path is in Ghost Admin’s post history modal and the corresponding context-resource rendering used by the admin UI; it affects staff-facing preview surfaces, not the public theme layer.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Improper Authorization in RouterController._getSubscriptionCheckoutData through the subscription offer redemption flow in core/server/controllers/router.js. An attacker can redeem an archived or otherwise inactive subscription offer by submitting its offerId during checkout. This lets users obtain subscription benefits from offers that are no longer active, bypassing the intended offer lifecycle and allowing expired or archived promotions to be redeemed.

Notes

• The vulnerable path accepts any offer object returned by offersAPI.getOffer; the inactive-offer check is only relevant when the offer record still carries a status field, so offers without a status value were not constrained by this validation point.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the ImageSize._fetchImageSizeFromUrl path in core/server/lib/image/image-size.js. An attacker can make Ghost send blind HTTP GET requests to internal hosts by supplying an external image URL that is fetched for image-size detection. This lets a staff-level user probe internal services and open ports from the Ghost server, with no response body returned to the attacker.

Notes

• Staff-level access in Ghost Admin is required; the vulnerable image-size lookup is reachable through the admin-side image handling flow rather than public site requests.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Information Exposure via the posts and pages browse and export filtering paths in PostsService, PostsExporter, and the posts/pages admin controllers. An attacker can leak other staff users’ password hashes by sending an admin API request with a crafted filter such as authors.password:abcd on /posts, /posts/export, or /pages.

Notes

• The leak only applies to staff-admin requests that use the admin API browse/export filter syntax on posts or pages; the maintainer advisory says the hashes were exposed to any staff-level user.

Workarounds

• Enable Multi-factor Authentication (MFA) for all staff users to reduce the chance that a recovered password hash can be used to log in and take over an account.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Directory Traversal through the theme upload validation in services/themes/storage.js and LocalStorageBase.ts. An attacker can write files outside the uploads directory by uploading a custom theme with a name that resolves to path elements such as . or .., causing the storage code to accept a target path outside the intended theme directory. This lets a staff user place files elsewhere on disk and alter the behavior of the installation.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Session Fixation due to the createSessionForUser logic in ghost/core/core/server/services/auth/session/session-service.js. An attacker can reuse a pre-set session identifier by getting a victim to authenticate on the same Ghost Admin domain, causing the victim’s login to bind to an attacker-known session. This lets the attacker hijack the authenticated admin session after login and act as that user, exposing admin access and any data or actions available in Ghost Admin.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the handling of the x-ghost-preview header when the application is deployed behind a shared caching layer. An attacker can inject malicious content into cached responses by sending crafted requests with this header, causing subsequent visitors to receive altered frontend pages. This can lead to account takeover if the frontend and admin panel are hosted on the same domain. This is only exploitable if a shared cache is configured to serve cached content across users and the frontend and admin panel are on the same domain.

Upgrade ghost to version 6.37.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). An attacker can execute arbitrary code on the server by submitting a specially crafted malicious theme.

Upgrade ghost to version 6.19.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to SQL Injection in the the slug filter ordering logic in the Content API. An attacker can access and read arbitrary data from the database by injecting crafted SQL queries through the filter parameter in API requests.

Upgrade ghost to version 6.19.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Improper Neutralization of Formula Elements in a CSV File during a member CSV export. An attacker can execute arbitrary commands by injecting maliciously crafted CSV content.

Upgrade ghost to version 5.82.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an SVG profile picture upload. A contributor user can cause scripts to be executed as owner.

Upgrade ghost to version 5.83.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the excerpt.js component. An attacker can inject and execute arbitrary script code in the context of the user's browser session by crafting a malicious post excerpt.

Upgrade ghost to version 5.76.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Arbitrary File Read which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system.

Note: Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder.

Upgrade ghost to version 5.59.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Directory Traversal due to allowing remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/. This occurs in frontend/web/middleware/static-theme.js file.

Upgrade ghost to version 5.42.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Information Exposure such that due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.

Upgrade ghost to version 5.46.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Access Restriction Bypass that allows contributors to view draft posts of other users via the /ghost/api/admin/posts endpoint and draft pages of other users via the /ghost/api/admin/pages endpoint.

NOTE: The vendor's position is that this behavior has no security impact.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the codeinjection_foot field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the codeinjection_head field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the facebook field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the twitter field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.