Summary
Ghost: Remote Code Execution via Theme Translation Files
Advisory details
Impact
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.
Vulnerable versions
This vulnerability is present in Ghost from v6.10.3 up to v6.64.0.
Patches
v6.64.0 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks Miguel Segovia Gil of KPMG, Alemmi, and Tomer-PL for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
References
- https://github.com/advisories/GHSA-jj74-hc2q-xrvm
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-jj74-hc2q-xrvm
- https://nvd.nist.gov/vuln/detail/CVE-2026-105677
- https://github.com/TryGhost/Ghost/issues/30635
- https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02
- https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
- HIGHCVE-2026-77271
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
- CRITICALCVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
- HIGHCVE-2026-62680
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
- HIGHCVE-2026-82393
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
- HIGHCVE-2026-86063
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning