Threats tagged 'ghsa-hqq2-xqr2-fmx2'

CVE-2026-105644 is a cross-site scripting (XSS) vulnerability in TryGhost Ghost that affects versions from 4.0.0 up to 6.66.x. The issue arises because SVG images included in content imports were stored without proper sanitization. An attacker who tricks an Administrator into importing a crafted SVG file could host malicious scripts on the site's domain, potentially compromising admin user sessions. The vulnerability is fixed in version 6.67.0.