Description
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TryGhost | Ghost | 6.10.3 – < 6.64.0 | 6.64.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ghost | >= 6.10.3, < 6.64.0 | 6.64.0 | GHSA-jj74-hc2q-xrvm |
References
- GitHub Security Advisory (GHSA-jj74-hc2q-xrvm) vendor-advisory
- VulnCheck Advisory: Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files third-party-advisory