CVE-2026-24778Disclosure(ghost / ghost)

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Ghost Portal versions 2.29.1 through 2.51.4 and 2.52.0 through 2.57.0 were vulnerable to this issue. Ghost automatically loads the latest patch of the members Portal component via CDN. For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability. v5.121.0 loads Portal v2.51.5, which contains the patch. For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability. v6.15.0 loads Portal v2.57.1, which contains the patch. For Ghost installations using a customized or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version.

ghost CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/TryGhost/Ghost/commit/da858e640e88e69c1773a7b7ecdc2008fa143849

Vendor / third-party advisories

https://github.com/TryGhost/Ghost/security/advisories/GHSA-gv6q-2m97-882h

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ghost
portal

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 4 classified signals
Peaked 1d ago at 2 mentions (2026-01-27); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

ghost

Products

ghostportal

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Full discourse4 posts

cvereports@_cvereports253d
Disclosure
CVE-2026-24778: Ghost in the Shell: Unmasking the Portal XSS (CVE-2026-24778) A critical Reflected Cross-Site Scripting (XSS) vulnerability exists in the 'Portal' component of Ghost CMS. By manipulating the configuration options passed via URL paramet... https://cvereports.com/reports/CVE-2026-24778
Post summary
The text announces a critical reflected XSS vulnerability in Ghost CMS's Portal component, providing a brief technical description and a link to a report.
0000056
29 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds254d
Disclosure
CVE-2026-24778 Cross-Site Scripting in Ghost CMS Portal Affecting Multiple Versions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24778
Post summary
The text announces CVE‑2026‑24778 as a Cross‑Site Scripting vulnerability in Ghost CMS but provides no proof of exploitation, PoC, or mitigation.
0000060
4.0K followersView on X
The Hacker Wire@TheHackerWire254d
Disclosure
🟠 CVE-2026-24778 - High Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an ... https://www.thehackerwire.com/vulnerability/CVE-2026-24778/ https://t.co/hjdrLwrALA
Post summary
The tweet announces a high‑severity CVE‑2026‑24778 in Ghost CMS affecting specific version ranges, noting that attackers can craft malicious links to exploit the flaw, but provides no PoC, exploit code, active exploitation evidence, or patch info.
0000058
113 followersView on X
CVE@CVEnew254d
Disclosure
CVE-2026-24778 Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link t… https://www.cve.org/CVERecord?id=CVE-2026-24778
Post summary
The snippet reports CVE-2026-24778 for Ghost CMS, indicating attackers can craft malicious links across certain versions, but offers no PoC, patch, or detailed technical information.
00000197
56.5K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ghost	ghost	-	node.js	-
App	ghost	portal	-	node.js	-

Explore more

Back to dashboard ghost CVEs ghost vulnerabilities

What researchers are saying

CVE-2026-24778

cvereports@_cvereportsDisclosure

The text announces a critical reflected XSS vulnerability in Ghost CMS's Portal component, providing a brief technical description and a link to a report.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE‑2026‑24778 as a Cross‑Site Scripting vulnerability in Ghost CMS but provides no proof of exploitation, PoC, or mitigation.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces a high‑severity CVE‑2026‑24778 in Ghost CMS affecting specific version ranges, noting that attackers can craft malicious links to exploit the flaw, but provides no PoC, exploit code, active exploitation evidence, or patch info.

CVE@CVEnewDisclosure

The snippet reports CVE-2026-24778 for Ghost CMS, indicating attackers can craft malicious links across certain versions, but offers no PoC, patch, or detailed technical information.