PT-2026-5028 · Ghost · Ghost+1

Younes Belalia · Publicado 2026-01-27 · Atualizado 2026-02-03 · CVE-2026-24778

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghost versions 5.43.0 through 5.12.04 Ghost versions 6.0.0 through 6.14.0 Ghost Portal versions 2.29.1 through 2.51.4 Ghost Portal versions 2.52.0 through 2.57.0

Description Ghost is a content management system. An attacker can create a malicious link that, when accessed by an authenticated staff user or member, executes JavaScript with the victim's permissions, potentially leading to account takeover.

Recommendations For Ghost 5.x installations, upgrade to version 5.121.0 or later. For Ghost 6.x installations, upgrade to version 6.15.0 or later. For Ghost installations using a customized or self-hosted version of Portal, manually rebuild from or update to the latest patch version.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-GHOST-2026-24778

CVE-2026-24778

GHSA-GV6Q-2M97-882H

Produtos afetados

Ghost

Ghost Portal

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24778.json · Exploit
• https://github.com/TryGhost/Ghost · Nota
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-gv6q-2m97-882h · Aviso do Fabricante
• https://github.com/TryGhost/Ghost/commit/da858e640e88e69c1773a7b7ecdc2008fa143849 · Correção
• https://twitter.com/_cvereports/status/2016612455086981240 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2016278990290583896 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-ghost-2026-24778 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gv6q-2m97-882h · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2016358649866649865 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2016285028737843652 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24778 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-24778 · Aviso do Fabricante