Ghost, a Node.js CMS, had a flaw in how it loads theme translation files from versions 6.10.3 to before 6.64.0. An authenticated administrator could upload a specially crafted theme containing arbitrary code, resulting in full control over the server. This exploitation relies on unauthorized file inclusion (CWE-22), improper access control to privileged functions (CWE-829), and code injection executed on the server (CWE-94).

Affected products include TryGhost's Ghost CMS. Vulnerable releases span from 6.10.3 up to, but not including, 6.64.0. Subsequent versions beginning with 6.64.0 contain the fix.

The CVSS score of 7.2 signifies high severity. There is no EPSS data and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. However, the attack requires valid administrator credentials and the ability to deploy a malicious theme, so the practical risk depends on the credentials used and the trust environment of the administrators. The available fix in version 6.64.0 removes the code path that loads translation files, effectively eliminating the RCE vector.