CVE-2026-24778
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Ghost CMS that allows attackers to craft malicious links. When authenticated staff users or members click these links, JavaScript executes with their permissions, potentially leading to account takeover. Affected versions include Ghost 5.43.0-5.12.04, 6.0.0-6.14.0, and Portal 2.29.1-2.51.4, 2.52.0-2.57.0.
💻 Affected Systems
- Ghost CMS
- Ghost Portal
📦 What is this software?
Ghost by Ghost
Ghost by Ghost
Portal by Ghost
Portal by Ghost
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of administrative staff users leading to full system compromise, data theft, and website defacement.
Likely Case
Session hijacking and privilege escalation for authenticated users, potentially leading to unauthorized content modifications.
If Mitigated
Limited impact if proper content security policies and user awareness training are implemented.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but is straightforward once the link is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ghost 5.121.0+ or 6.15.0+; Portal 2.51.5+ or 2.57.1+
Vendor Advisory: https://github.com/TryGhost/Ghost/security/advisories/GHSA-gv6q-2m97-882h
Restart Required: Yes
Instructions:
1. For Ghost 5.x: Upgrade to v5.121.0 or later. 2. For Ghost 6.x: Upgrade to v6.15.0 or later. 3. For custom Portal installations: Manually update to Portal v2.51.5+ (for Ghost 5.x) or v2.57.1+ (for Ghost 6.x). 4. Restart Ghost service after upgrade.
🔧 Temporary Workarounds
Content Security Policy (CSP)
allImplement strict CSP headers to block inline JavaScript execution and restrict script sources.
User Awareness Training
allTrain staff and members to avoid clicking suspicious links and recognize phishing attempts.
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to mitigate XSS impact
- Disable or restrict member/staff access to external links within the CMS
🔍 How to Verify
Check if Vulnerable:
Check Ghost version via admin panel or run: ghost versionCheck Version:
ghost versionVerify Fix Applied:
Confirm Ghost version is 5.121.0+ or 6.15.0+ and Portal version is 2.51.5+ or 2.57.1+📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution in user sessions
- Suspicious URL parameters in access logs
Network Indicators:
- Requests containing malicious script payloads in URL parameters
SIEM Query:
source="ghost_access.log" AND (url="*javascript:*" OR url="*<script>*")