Executive brief
Ghost is a popular open-source blogging and content management platform used to publish and manage websites. An attacker with administrator access can upload a specially crafted theme that executes arbitrary code on the server hosting Ghost, potentially compromising the entire system, stealing customer data, or disrupting service availability. This requires administrator privileges and user action to install the theme, limiting immediate risk to organizations with good access controls.
Technical details
The vulnerability exists in Ghost's theme handling mechanism, allowing arbitrary code execution through maliciously crafted theme files. The root cause is insufficient validation and sandboxing of theme code during installation and execution. Exploitation requires administrator privileges to upload a theme and the administrator to interact with the malicious theme (e.g., activate it), making this a high-privilege, high-interaction attack vector delivered over the network. A successful exploit grants an attacker arbitrary code execution in the context of the Ghost server process, potentially leading to full system compromise. The vulnerability affects Ghost versions 0.7.2 through 6.19.0; patch v6.19.1 remediates the issue.
Affected products
- Ghost Foundation Ghost 0.7.2 to 6.19.0
Timeline
- 2026-03-03: disclosed: Vulnerability published by Ghost Foundation
- 2026-03-03: patched: Patch v6.19.1 released