CVE-2026-70596 — Ghost: Cross-Site Scripting in Feature Image Captions
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption th…
Published: 2026-08-05 · CVSS: 4.3 · CVSS 3.1
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7