---
id: CVE-2026-105651
title: Ghost is a Node.js content management system
summary: >-
  Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when
  creating a bookmark card, Ghost could store non-image files fetched from an
  external website as bookmark icons or thumbnails. This allowed any staff user,
  inclu…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-79
  - CWE-434
vendor: TryGhost
product: Ghost
affected:
  - 'Ghost >= 5.94.0, < 6.64.0'
published: '2026-10-05'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T20:17:14.010'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105651'
references:
  - url: >-
      https://github.com/TryGhost/Ghost/commit/b41fe3f2c399cef058e6b487782a0b2263e86c03
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/issues/30761'
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/releases/tag/v6.64.0'
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-05T19:30:59.996Z'
---

## Overview

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.