Executive brief
Ghost, a popular open-source publishing platform, is vulnerable to a cache poisoning attack that could allow an attacker to take over staff accounts. By sending a specially crafted request, an attacker can trick shared caching services (like Cloudflare or Fastly) into storing a malicious version of a page. Subsequent visitors, including administrators, who view the poisoned page could have their accounts compromised if the frontend and admin panel share the same domain.
Technical details
Ghost is vulnerable to cache poisoning leading to Cross-Site Scripting (XSS). An unauthenticated remote attacker can send a request containing a malicious 'x-ghost-preview' header; if Ghost is behind a shared caching layer (e.g., Fastly, Cloudflare, Nginx proxy_cache) that does not account for this header in its cache key, the altered response may be cached. When the frontend and admin panel share a domain, this allows for the execution of arbitrary scripts in the context of staff users, enabling account takeover. The vulnerability is present in versions 4.0.0 through 6.36.0 and is patched in version 6.37.0. A workaround involves configuring the caching layer to bypass the cache for requests containing the 'x-ghost-preview' header.
Affected products
- Ghost Foundation Ghost 4.0.0 - 6.36.0
Timeline
- 2026-05-28: disclosed: Vulnerability reported to Ghost Foundation
- 2026-06-24: advisory: NVD publication date
- 2026-07-01: advisory: GitHub Advisory published/reviewed