CVE-2026-105676

4.9 MEDIUMpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-22, CWE-73

Public exploit & PoC references

https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02
https://github.com/TryGhost/Ghost/issues/30635
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-m382-6jw4-fmp6

All references

https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02
https://github.com/TryGhost/Ghost/issues/30635
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-m382-6jw4-fmp6

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-101126
UNSCOREDCVE-2026-104805
UNSCOREDCVE-2026-104853PoC
HIGHCVE-2026-105744PoC
HIGHCVE-2026-105865PoC
HIGHCVE-2026-106103PoC
UNSCOREDCVE-2026-106109PoC
MEDIUMCVE-2026-106494PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.