Threats tagged 'ghsa-8575-cr6v-7jh4'

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost where SVG media thumbnails and SVG images uploaded with incorrect file extensions were stored without proper sanitization. This flaw allows any staff user, including Contributors, to host malicious scripts on the site's domain, potentially compromising other staff users' admin sessions. The vulnerability affects Ghost versions from 4.22.0 up to but not including 6.65.0. Version 6.65.0 contains a fix for this issue.