CVE-2026-105681

6.5 MEDIUMpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-943

Public exploit & PoC references

https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3
https://github.com/TryGhost/Ghost/pull/28297
https://github.com/TryGhost/Ghost/releases/tag/v6.44.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477

All references

https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3
https://github.com/TryGhost/Ghost/pull/28297
https://github.com/TryGhost/Ghost/releases/tag/v6.44.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100631PoC
MEDIUMCVE-2026-102988PoC
HIGHCVE-2026-103250PoC
MEDIUMCVE-2026-103258PoC
MEDIUMCVE-2026-103289PoC
MEDIUMCVE-2026-104956PoC
LOWCVE-2026-105652PoC
HIGHCVE-2026-105675PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.