CVE-2026-105677: Ghost CMS RCE Vulnerability

CVE-2026-105677 Overview

CVE-2026-105677 is a path traversal vulnerability [CWE-22] in Ghost, a Node.js content management system. The flaw exists in how Ghost loads theme translation files, allowing an authenticated Administrator to execute arbitrary code on the server by uploading a crafted theme. The vulnerability affects Ghost versions from 6.10.3 up to (but not including) 6.64.0 and is resolved in release 6.64.0.

Critical Impact
An authenticated Administrator can achieve arbitrary code execution on the Ghost server through a crafted theme containing malicious translation files, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Ghost (Node.js CMS) versions 6.10.3 through 6.63.x
Self-hosted Ghost deployments permitting theme uploads
Ghost installations with Administrator-level accounts

Discovery Timeline

2026-10-05 - CVE-2026-105677 published to NVD
2026-10-06 - Last updated in NVD database
Ghost v6.64.0 - Patched release available on the TryGhost GitHub Releases page

Technical Details for CVE-2026-105677

Vulnerability Analysis

Ghost loads theme translation files when a custom theme is installed through the Administrator interface. The theme loader resolves translation file paths without sufficient validation, enabling an authenticated Administrator to supply a theme package that causes Ghost to load attacker-controlled files from unintended locations. Because the loader processes these files within the Node.js runtime, the attacker can execute arbitrary JavaScript in the context of the Ghost server process.

The issue is classified as a path traversal weakness [CWE-22]. Exploitation requires Administrator privileges, but the result is full server compromise rather than content-level manipulation.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory when loading theme translation (i18n) resources. Ghost did not constrain translation file resolution to the expected theme locale directory, so references crafted inside a theme package could escape that directory and point at arbitrary files loaded and evaluated by the application.

Attack Vector

An attacker with Administrator credentials uploads a theme package containing crafted translation references. When Ghost activates or loads the theme, the translation subsystem resolves and loads the attacker-controlled content, executing code on the server with the privileges of the Ghost process. Although the attack vector is Network, the high privilege requirement limits exploitation to accounts that already hold Administrator access or to attackers who have taken over such an account.

text

// Patch excerpt (apps/admin/src/settings/general/publication-language.tsx)
-import LOCALE_DATA from '@tryghost/i18n/lib/locale-data.json';
+import LOCALE_DATA from '@tryghost/i18n/locale-data.json';
 import React from 'react';
 import TopLevelGroup from '@/settings/components/top-level-group';
 import useSettingGroup from '@/settings/hooks/use-setting-group';

Source: TryGhost/Ghost commit d2f4986

typescript

// Patch excerpt (apps/admin/vite.shared.ts)
 import { createRequire } from 'node:module';
 import { resolve } from 'path';

+import { defaultClientConditions } from 'vite';
+
 const require = createRequire(import.meta.url);

Source: TryGhost/Ghost commit d2f4986

These patch hunks are part of the consolidation of @tryghost/i18n to a single TypeScript ESM source referenced in issue #30635, which accompanies the server-side hardening of translation file loading.

Detection Methods for CVE-2026-105677

Indicators of Compromise

Theme uploads or activations originating from Administrator accounts outside normal change windows
Theme packages containing locale or translation files with path separators, .. sequences, or non-standard file extensions
Unexpected child processes spawned by the Ghost Node.js process after a theme change
New or modified files outside the content/themes/<theme>/locales/ directory following a theme upload

Detection Strategies

Monitor Ghost application logs for theme install, activate, and reload events, correlating them with Administrator session activity
Review theme archive contents prior to installation for translation files referencing paths outside the theme root
Alert on outbound network connections initiated by the Ghost process to previously unseen destinations
Track Ghost version strings in HTTP responses to identify instances running 6.10.3 through 6.63.x

Monitoring Recommendations

Enable file integrity monitoring on the Ghost content/ directory and the Node.js runtime files
Forward Ghost server and reverse-proxy logs to a central SIEM for retention and correlation
Audit the list of Administrator accounts and enforce multi-factor authentication for each
Baseline the Ghost process behavior and alert on deviations such as new file writes or process spawns

How to Mitigate CVE-2026-105677

Immediate Actions Required

Upgrade Ghost to version 6.64.0 or later without delay
Audit Administrator accounts and remove any that are unused or unnecessary
Rotate credentials and API keys for Administrator users if compromise is suspected
Review recently uploaded or activated themes and remove any that are unknown or untrusted

Patch Information

The vulnerability is fixed in Ghost 6.64.0. Release notes and binaries are available on the Ghost v6.64.0 release page. The underlying code changes are documented in GitHub Security Advisory GHSA-jj74-hc2q-xrvm and the upstream commit d2f4986.

Workarounds

Restrict theme upload permissions to a minimal set of trusted Administrators until the patch is applied
Install only themes obtained from the official Ghost marketplace or verified first-party sources
Place the Ghost admin interface behind a VPN or IP allowlist to limit the exposure of Administrator endpoints
Run Ghost as an unprivileged system user inside a container or sandbox to limit the blast radius of code execution

bash

# Verify installed Ghost version and upgrade using Ghost-CLI
ghost version
ghost update 6.64.0
ghost restart