CyberRota Analysis
AI-GeneratedA stored cross-site scripting vulnerability exists in Ghost versions prior to 6.64.0, allowing staff users to exploit bookmark card image fetching to host arbitrary HTML. This could enable attackers to compromise the admin sessions of other staff users by embedding non-image files from external sources. Organizations using affected versions should prioritize patching to mitigate the risk of session hijacking and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.