CVE-2026-70596: Ghost CMS Privilege Escalation Vulnerability

CVE-2026-70596 Overview

CVE-2026-70596 is a stored cross-site scripting (XSS) vulnerability in Ghost, a Node.js content management system. The flaw exists in versions from 4.9.0 up to 6.54.1 and stems from improper input validation on the feature_image_caption field of a post. Any authenticated staff user can craft post content that executes in the browser of another staff user viewing the Ghost Admin interface. Successful exploitation hijacks the victim's Admin session and enables privilege escalation to higher-privileged staff accounts. The maintainers fixed the issue in Ghost 6.54.1 by sanitizing rendered content with DOMPurify [CWE-79].

Critical Impact
A low-privileged staff user can escalate privileges by hijacking another staff user's authenticated Ghost Admin session through malicious content stored in feature_image_caption.

Affected Products

Ghost CMS versions 4.9.0 through 6.54.0
Ghost Admin (Ember-based administration application)
Ghost Core frontend proxy service (ghost/core/core/frontend/services/proxy.js)

Discovery Timeline

2026-08-05 - CVE-2026-70596 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70596

Vulnerability Analysis

The vulnerability is a stored XSS issue tracked as [CWE-79]. Ghost stores post metadata, including feature_image_caption, in a form that permits HTML content. When a staff user views post history or renders content through the affected frontend proxy, the caption is inserted into the Ghost Admin DOM without adequate sanitization. Malicious script content persists in the database and executes in the context of any staff user who later views the post, including administrators.

Because the payload runs inside the authenticated Ghost Admin origin, the attacker inherits full session capabilities of the victim. This turns a content-authoring privilege into an account takeover primitive against higher-privileged users.

Root Cause

The root cause is missing output encoding and sanitization of the feature_image_caption field before rendering. The upstream fix in commit a8bea3a4ceec4c852b880f4885119453c3d8588e introduces DOMPurify in both the Ember admin post-history modal and the frontend proxy service, applying sanitization to untrusted caption content before it reaches the DOM or template engine.

Attack Vector

Exploitation requires an authenticated staff account with post-authoring rights and user interaction from a victim staff user who must view the malicious post or its history. The attack is network-reachable but constrained by the requirement for elevated authoring privileges and a triggering view by a second user.

javascript

// Patch: apps/ember-admin/app/components/modal-post-history.js
 import Component from '@glimmer/component';
+import DOMPurify from 'dompurify';
 import RestoreRevisionModal from '../components/modals/restore-revision';
 import {action, set} from '@ember/object';
 import {inject as service} from '@ember/service';

// Patch: ghost/core/core/frontend/services/proxy.js
 const {SafeString} = require('./handlebars');
 
+const createDOMPurify = require('dompurify');
+const {JSDOM} = require('jsdom');
+const DOMPurify = createDOMPurify(new JSDOM('').window);

Source: GitHub Commit a8bea3a. The fix wraps rendered content through DOMPurify.sanitize() to strip active script content before insertion.

Detection Methods for CVE-2026-70596

Indicators of Compromise

Post records containing <script>, onerror=, onload=, or javascript: sequences in the feature_image_caption column of the posts table.
Unexpected outbound requests from staff browsers to attacker-controlled hosts shortly after opening a post history modal in Ghost Admin.
Ghost Admin session tokens or API keys observed in HTTP request bodies to non-Ghost domains in web proxy logs.
Creation of new Owner or Administrator staff accounts immediately following a Content Editor authoring event.

Detection Strategies

Query the Ghost database for posts where feature_image_caption matches HTML tag or event-handler patterns and review authorship metadata.
Inspect Ghost Admin browser telemetry for anomalous script execution and cross-origin fetches originating from the /ghost/ administrative path.
Correlate staff role changes and API key generation events with recent post edits by lower-privileged users.

Monitoring Recommendations

Enable and centralize Ghost application logs, focusing on /ghost/api/admin endpoints for role, user, and integration modifications.
Monitor egress traffic from workstations used by editorial staff for connections to newly registered or uncategorized domains.
Alert on any modification of the roles_users join table outside of expected administrative windows.

How to Mitigate CVE-2026-70596

Immediate Actions Required

Upgrade Ghost to version 6.54.1 or later, which contains the DOMPurify-based sanitization fix.
Audit the posts table for existing malicious content in feature_image_caption and remove or neutralize entries containing HTML or script payloads.
Rotate Ghost Admin session secrets and API keys for any account that may have viewed a suspect post since the affected version was deployed.
Review staff user roles and remove any accounts or role assignments that cannot be attributed to a legitimate administrative action.

Patch Information

The vulnerability is resolved in Ghost 6.54.1. The fix is committed in GitHub Commit a8bea3a and discussed in GitHub Pull Request #29635. Release details are published under GitHub Release v6.54.1 and the coordinated advisory is available as GHSA-pr22-p9rp-2cqv.

Workarounds

Restrict staff account creation and limit post-authoring privileges to trusted users until the upgrade is applied.
Apply a reverse-proxy Content Security Policy (CSP) that blocks inline scripts on /ghost/ administrative routes to reduce XSS execution surface.
Manually strip HTML from the feature_image_caption field via a database sanitization script for deployments that cannot immediately upgrade.

bash

# Upgrade Ghost using the official Ghost-CLI
ghost update --version 6.54.1

# Verify installed version
ghost version

# Optional: audit existing posts for suspicious caption content
mysql -u ghost -p ghost_prod -e \
  "SELECT id, title, feature_image_caption FROM posts \
   WHERE feature_image_caption REGEXP '<script|on[a-z]+=|javascript:';"