CVE-2026-105679

Published 5 October 2026 · tracked since 6 October 2026

Description

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-95264
• CVE-2026-97257 HIGH 8.8
• CVE-2026-93617 HIGH 7.2
• CVE-2026-105766 LOW 3.1
• CVE-2026-105767 LOW 3.3
• CVE-2026-105683 LOW 3.8
• CVE-2026-105681 MEDIUM 6.5
• CVE-2026-105682 LOW 2.7
• CVE-2026-105680 MEDIUM 6.5
• CVE-2026-105651 HIGH 7.3

→ Open the live CVE board · all tools