All vulnerabilities
CVE-2026-105677BIT-ghost-2026-104418BIT-ghost-2026-105677CVE-2026-104418GHSA-jj74-hc2q-xrvm

Ghost: Remote Code Execution via Theme Translation Files

TryGhost ghostnpmApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.64.0Fixed versionGitHub
Published5 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

  • 6.64.0ghost, npmGitHubnpm install ghost@6.64.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.

Vulnerable versions

This vulnerability is present in Ghost from v6.10.3 up to v6.64.0.

Patches

v6.64.0 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

References

Ghost thanks Miguel Segovia Gil of KPMG, Alemmi, and Tomer-PL for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).

Text from GitHub Advisory Database

Affected versions 3

  • ghost, npm>= 6.10.3, < 6.64.0GitHub
  • Ghostaffected: >= 6.10.3, < 6.64.0CVE List
  • ghost, npmfrom 6.10.3, fixed in 6.64.0OSV

References 6