The vulnerability allows any staff user to upload a file that is served with a content type derived from the file extension. Because the default local storage adapter does not enforce a restricted set of content types, an attacker can host a malicious script on the domain. Successful execution of that script can then compromise the administrative session of other staff users. This is a stored cross‑site scripting flaw.

The flaw affects Ghost CMS versions 6.22.1 through 6.64.0. It applies to installations that use Ghost’s default local storage adapter. The affected vendor/product is TryGhost:Ghost. No specific sub‑versions beyond the range are listed, so any deployment within that range is vulnerable.

The CVSS score of 7.3 indicates a high severity. The exploit is possible without prior authentication beyond a staff account, so the scope is user session compromise. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the public file‑upload interface that staff can access, and the attacker only needs to upload a crafted file.