Is CVE-2026-105676 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105676 being exploited in the wild.

How severe is CVE-2026-105676?

Medium severity, with a CVSS score of 4.9, published 5 October 2026.

Which products and versions are affected?

ghost (npm) >= 1.20.0, < 6.64.0; TryGhost Ghost 1.20.0 to 6.63.0.

Is there a fix for CVE-2026-105676?

Yes: fixed in 6.64.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105676 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105676?

Check whether you run ghost (npm) or TryGhost Ghost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105676: Ghost path traversal in theme translation file loading

Q: Is there a fix for CVE-2026-105676?

Yes: fixed in 6.64.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-105676 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-105676?

Check whether you run ghost (npm) or TryGhost Ghost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105676 · Severity: medium · CVSS 4.9 · Published 2026-10-05

Ghost is a Node.js content management system used to host websites and blogs. Administrators with valid credentials could exploit a flaw in how Ghost loads theme translation files to read sensitive JSON files outside the intended theme directory, potentially exposing database credentials, API keys, and other server configuration secrets stored in these files.

Technologies: ghost (npm), TryGhost Ghost. Vendors: npm, TryGhost.

Quick answers

Is CVE-2026-105676 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105676 being exploited in the wild.
How severe is CVE-2026-105676?: Medium severity, with a CVSS score of 4.9, published 5 October 2026.
Which products and versions are affected?: ghost (npm) >= 1.20.0, < 6.64.0; TryGhost Ghost 1.20.0 to 6.63.0.
Is there a fix for CVE-2026-105676?: Yes: fixed in 6.64.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105676 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105676?: Check whether you run ghost (npm) or TryGhost Ghost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.64.0

Technical details

A path traversal vulnerability in Ghost's theme translation file loader allowed authenticated administrators to access JSON files outside the active theme directory. The vulnerability was in how @tryghost/i18n resolved file paths for localization data. An authenticated administrator could manipulate theme translation loading to read arbitrary JSON files on the server, exposing sensitive configuration data.

Affected products

TryGhost Ghost 1.20.0 to 6.63.0

Identifiers

CVE-2026-105676
GHSA-m382-6jw4-fmp6

Timeline

2026-10-05: disclosed
2026-09-09: patched: Fix merged in PR #30635

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.