CVE-2026-70596CWE-79cross-site-scripting

CVE-2026-70596

Medium · published August 5, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
23.5
In the wild
Unconfirmed
What it is

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00318 · 23.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-05T20:17Z
References (4)
https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e · [email protected]https://github.com/TryGhost/Ghost/pull/29635 · [email protected]https://github.com/TryGhost/Ghost/releases/tag/v6.54.1 · [email protected]https://github.com/TryGhost/Ghost/security/advisories/GHSA-pr22-p9rp-2cqv · [email protected]
EPSS history
Timeline
  • 05 AUG 14:40Z
    Ghost: Cross-Site Scripting in Feature Image Captions
    cvelistv5