Skip to content
OpenAdvisories

Package · npm

ghost

62 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-23724 Public exploit

    Ghost has possible Cross-site Scripting issue

    Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer rep…

    ghost npm
  • Medium 4.9
    CVE-2023-40028 Public exploit EPSS 66%

    Arbitrary file read via symlinks in Ghost

    Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host oper…

    TryGhost Ghost ghost npm