{"vulnerability": "GHSA-2gx6-7gx2-wwcf", "sightings": [{"uuid": "fdedc0da-27a6-4050-a961-ad1508d1482e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2gx6-7gx2-wwcf", "type": "seen", "source": "https://gist.github.com/alon710/98861561e950349ba52fdd407f74f7c8", "content": "# CVE-2026-70588: CVE-2026-70588: Stored Cross-Site Scripting via Universal Import in Ghost CMS\n\n> **CVSS Score:** 5.0\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70588\n\n## Summary\nCVE-2026-70588 is a stored Cross-Site Scripting (XSS) vulnerability in Ghost CMS versions 5.26.0 through 6.54.0. The vulnerability exists within the Universal Import feature of the Ghost Admin interface. When processing imported content from third-party platforms such as Revue, the importer fails to sanitize user-controlled HTML tags, rich-text structured JSON, or link fields before rendering them in the Ghost Admin panel and front-end template rendering contexts.\n\n## TL;DR\nA stored Cross-Site Scripting (XSS) vulnerability in Ghost CMS (versions 5.26.0 to 6.54.0) allows administrative users to inject malicious scripts via the Universal Import feature, leading to administrative session hijacking when other users view the imported content.\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Severity**: 5.0 (Medium)\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.26.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.54.1 or later to apply input sanitization and URL validation.\n- Restrict 'Administrator' and high-privileged roles to verified personnel to minimize rogue imports.\n- Deploy a Content Security Policy (CSP) to restrict inline script execution and enforce trusted endpoints.\n\n**Remediation Steps:**\n1. Access the host machine hosting the Ghost installation via SSH.\n2. Navigate to the Ghost installation root directory.\n3. Run the command 'ghost update' to pull the latest safe release.\n4. Execute database queries to check for existing script injections in image captions or post contents.\n5. Sanitize or remove any flagged database entries manually if malicious records are identified.\n\n## References\n\n- [GitHub Security Advisory GHSA-2gx6-7gx2-wwcf](https://github.com/TryGhost/Ghost/security/advisories/GHSA-2gx6-7gx2-wwcf)\n- [Fix Commit a8bea3a4](https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e)\n- [Ghost Pull Request 29635](https://github.com/TryGhost/Ghost/pull/29635)\n- [Ghost Release Tag v6.54.1](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70588) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T11:31:33.268951Z"}]}