CVE-2026-103278 is a high-severity vulnerability in TryGhost Ghost CMS affecting versions >=5.8.0 and <6.34.0. It involves a relative path traversal issue in the admin iframe component, enabling attackers who have content publishing rights to create malicious pages. When these pages are accessed by active staff users, the attackers can hijack their accounts due to insufficient input validation. The CVSS 4.0 score is 8.5, indicating a high impact with network attack vector, low attack complexity, no privileges required beyond publishing rights, and requiring user interaction.

Successful exploitation allows attackers with content publishing privileges to take over staff user accounts, potentially leading to unauthorized administrative access and control within the Ghost CMS environment.

A fixed version is available starting from 6.34.0. Users should upgrade Ghost to version 6.34.0 or later to remediate this vulnerability. No other mitigation guidance is provided.