CVE-2026-104411 Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
Staff users can upload malicious files to execute scripts in other staff members' admin sessions, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-104411?
CVE-2026-104411 is a high-severity cross-site scripting vulnerability in TryGhost Ghost, published on 2 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.
Weakness: CWE-79
Which versions are affected by CVE-2026-104411?
How do I fix CVE-2026-104411?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-104411 being exploited?
There is no known exploitation of CVE-2026-104411 in the wild and no public exploit code.
Sources
Also known as GHSA-6v5j-39pg-pv7v, MINI-qvxm-f25v-x4wg.