CyberRota Analysis
AI-GeneratedGhost versions prior to 6.64.0 are susceptible to a stored cross-site scripting vulnerability that enables staff users to upload malicious scripts via files with specific content types. This flaw could allow attackers to compromise the admin sessions of other staff users by exploiting the uploaded scripts. Organizations using affected versions should prioritize patching to mitigate the risk of session hijacking and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.