MajorCritical vulnerability
CVE-2026-104413 (CVSS 8.5)
NVD · officialPublished Oct 2, 2026Risk 37/100
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.
Technical details
CVSS
8.5
AV:NetworkAC:LowPR:LowUI:Passive
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source