CVE-2026-105645

medium

Description

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq

https://github.com/TryGhost/Ghost/releases/tag/v6.66.0

https://github.com/TryGhost/Ghost/issues/31058

https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92635

Details

Source: Mitre, NVD

Published: 2026-10-05

Updated: 2026-10-06

Risk Information

CVSS v2

Base Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:N/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 4.9

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Severity: Medium

EPSS

EPSS: 0.00327