Ghost, a Node.js CMS, contains a stored cross‑site scripting flaw in media handling. From version 4.22.0 through 6.65.0, SVG thumbnails and images uploaded with a non‑SVG file extension were saved without sanitization. A staff user, including those with Contributor privileges, can upload such a file containing malicious JavaScript that runs in the browser of any other staff member who views the media, enabling the attacker to hijack administrator sessions and potentially execute commands on the server. The vulnerability is a classic example of insecure file upload (CWE‑434) combined with reflected XSS (CWE‑79).

The affected product is Ghost, the content management system from TryGhost. Vulnerable versions span from 4.22.0 up to, but not including, 6.65.0. Any deployment of Ghost within that range that permits staff uploads of SVG files with non‑SVG extensions is susceptible.

The CVSS score is 7.3, indicating high severity. The exploit probability score (EPSS) is not available, but the absence of a KEV listing suggests there is no confirmed exploitation yet. Attackers would need a staff user account with permission to upload media and would place a crafted SVG containing JavaScript into the upload. Because the vulnerability allows code to execute within the context of other staff members' browsers, it has the potential to lead to compromise of administrative accounts and lateral movement. The flaw remains unpatched until the customer upgrades to Ghost 6.65.0 or newer, which includes the necessary sanitization.