CVE-2026-105645

4.9 MEDIUMpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-1333

Public exploit & PoC references

https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce
https://github.com/TryGhost/Ghost/issues/31058
https://github.com/TryGhost/Ghost/releases/tag/v6.66.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq

All references

https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce
https://github.com/TryGhost/Ghost/issues/31058
https://github.com/TryGhost/Ghost/releases/tag/v6.66.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100267
UNSCOREDCVE-2026-101903PoC
UNSCOREDCVE-2026-101906PoC
MEDIUMCVE-2026-102270PoC
MEDIUMCVE-2026-102408
MEDIUMCVE-2026-102473
UNSCOREDCVE-2026-102990PoC
HIGHCVE-2026-103043PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.