CyberRota Analysis
AI-GeneratedThe Ghost content management system, versions 4.9.0 to 6.54.1, is vulnerable to an input validation flaw that enables staff users to craft posts with malicious content in the feature_image_caption field, potentially hijacking another staff user's admin session and leading to privilege escalation. Organizations using affected versions should prioritize patching to version 6.54.1 or later to mitigate this risk and protect their administrative access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.