PT-2026-5028 · Ghost · Ghost+1

Younes Belalia · Published 2026-01-27 · Updated 2026-02-03 · CVE-2026-24778

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghost versions 5.43.0 through 5.12.04 Ghost versions 6.0.0 through 6.14.0 Ghost Portal versions 2.29.1 through 2.51.4 Ghost Portal versions 2.52.0 through 2.57.0

Description Ghost is a content management system. An attacker can create a malicious link that, when accessed by an authenticated staff user or member, executes JavaScript with the victim's permissions, potentially leading to account takeover.

Recommendations For Ghost 5.x installations, upgrade to version 5.121.0 or later. For Ghost 6.x installations, upgrade to version 6.15.0 or later. For Ghost installations using a customized or self-hosted version of Portal, manually rebuild from or update to the latest patch version.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-GHOST-2026-24778

CVE-2026-24778

GHSA-GV6Q-2M97-882H

Affected Products

Ghost

Ghost Portal

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24778.json · Exploit
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-gv6q-2m97-882h · Vendor Advisory
• https://github.com/TryGhost/Ghost/commit/da858e640e88e69c1773a7b7ecdc2008fa143849 · Patch
• https://osv.dev/vulnerability/BIT-ghost-2026-24778 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gv6q-2m97-882h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24778 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24778 · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://twitter.com/_cvereports/status/2016612455086981240 · Twitter Post
• https://twitter.com/CVEnew/status/2016278990290583896 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016358649866649865 · Twitter Post
• https://twitter.com/TheHackerWire/status/2016285028737843652 · Twitter Post