CVE-2026-103278

7.3 HIGHpublic exploit available

Published 2026-10-01 · Updated 2026-10-01

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through improper input validation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE-23

Public exploit & PoC references

https://github.com/TryGhost/Ghost/security/advisories/GHSA-5pxf-whwv-g54g

All references

https://github.com/TryGhost/Ghost/security/advisories/GHSA-5pxf-whwv-g54g
https://www.vulncheck.com/advisories/ghost-5.8.0-before-6.34.0-staff-account-takeover-via-admin-iframe

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-101024PoC
UNSCOREDCVE-2026-102252PoC
UNSCOREDCVE-2026-103508
UNSCOREDCVE-2026-103663
MEDIUMCVE-2026-105275PoC
MEDIUMCVE-2026-106490PoC
MEDIUMCVE-2026-106552
UNSCOREDCVE-2026-10739

Related by shared AI tags and CWE weakness class. Browse the full archive.