CyberRota Analysis
AI-GeneratedVersions of Ghost from 5.8.0 to 6.34.0 are vulnerable due to an input validation flaw in the admin iframe, which can be exploited by attackers with content publishing privileges to create malicious pages. When these pages are accessed by active staff users, it can lead to account takeover, compromising user accounts and potentially sensitive information. Organizations using affected versions should prioritize patching this vulnerability to protect their staff accounts and maintain system integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through improper input validation.