Ghost's September Patch Run: 43 Advisories, One RCE, and the Admin Plumbing That Carries Them

Ghost shipped six releases between September 15 and September 29, a 15-day span, and the reason is a cluster of flaws that landed in the NVD between October 1 and October 5. Fifty-four NVD records, 43 GitHub security advisories from the maintainers, 22 of them high severity, with a maximum CVSS of 8.8. For a publishing platform, that is an unusual amount of movement, and the shape of the cluster is what matters.

The RCE hides in the translation files

The most severe item is a remote code execution in theme translation files, tracked as CVE-2026-104418 (GHSA-jj74-hc2q-xrvm, CVSS 7.2, CWE-22 path traversal). It affects versions 6.10.3 through before 6.64.0 and is fixed in 6.64.0. The mechanism is a path traversal: a crafted translation file path reaches outside the theme directory, and a file placed there ends up being executed by the platform. Translation files are a quiet part of a CMS, which is what makes this one worth reading carefully. The attack surface is not your content. It is the machinery that loads your theme's strings.

The authentication layer is where it gets worse

The high-severity group is dominated by authentication and authorization problems, and they all point at the same subsystem: the staff account model.

• A suspended-staff password reset bypass (CVE-2026-103268, CVSS 8.8) lets a reset flow succeed for an account that was supposed to be locked out.
• A session handling authentication bypass (CVE-2026-103283, CVSS 8.1) breaks the check that ties a session to a verified user.
• A staff token authorization bypass (CVE-2026-103273) lets a token act beyond the role it was issued for.
• A content API staff enumeration (CVE-2026-103272, CVSS 7.5) exposes which staff accounts exist.
• A notification privilege escalation (CVE-2026-103286, CVSS 7.3) lets a notification flow grant more access than it should.

Read together, these are not five unrelated bugs. They are five places where a state change (suspend, reset, token issue, enumeration, notification) failed to enforce the permission it was supposed to carry. An attacker who lands any one of them does not own a blog post. They own a staff identity, and from there the blast radius is admin access, content, and the other sites on the same installation.

Stored XSS and SSRF round out the cluster

The medium band is mostly stored cross-site scripting: local storage file uploads (CVE-2026-104411), bookmark card images (CVE-2026-104413), oEmbed photo responses (CVE-2026-104414, CVSS 8.1), and untrusted script execution in the oEmbed preview feature (CVE-2026-103277, CVSS 8.1). The oEmbed pair is the notable one. A preview feature that fetches an external embed and renders its response is a standing invitation to run someone else's script in your admin interface. Two server-side request forgery issues complete the set: webhooks (CVE-2026-103287) and image dimension refetching (CVE-2026-103291), both letting the platform be pointed at internal addresses.

What to do

The fixes are spread across releases 6.57.1, 6.62.0, 6.63.0, 6.64.0, 6.65.0, and 6.66.0/6.67.0. The version to be on is 6.67.0, and there is a concrete reason: 6.66.0 was never published to npm because of a packaging failure, so an upgrade path that stops at 6.66.0 does not exist. If your install is on 6.10.3 or newer, the RCE alone is grounds to move.

Three checks follow the upgrade. First, review staff accounts: who is suspended, who holds tokens, and whether any reset flow completed for an account that should have stayed locked. Second, look at sessions for anything that outlived the user it belongs to. Third, audit webhook targets and oEmbed usage, since those are the two SSRF and script-execution doors.

One nuance on dates: the NVD records for this cluster were published October 1 to October 5, while some of the maintainer advisories carry GitHub publication dates as late as October 7. That is a publication-date gap between the two feeds, not a change in the underlying events. And a note on scope: no Tier-1 source in this run asserts active in-the-wild exploitation of this cluster, and it does not appear in CISA KEV. Treat it as a patch cycle, not a breach.

The 43-versus-54 count is also worth a line. More NVD records than advisories means at least some advisories cover multiple CVEs, so per-CVE fixed-version detail lives in the GHSA feed rather than in any single release note. Check the feed, not the release notes, when you map a specific CVE to a release.

Sources

• NVD record, CVE-2026-104418 (RCE via theme translation files): https://nvd.nist.gov/vuln/detail/CVE-2026-104418
• GitHub Security Advisory GHSA-jj74-hc2q-xrvm: https://github.com/TryGhost/Ghost/security/advisories/GHSA-jj74-hc2q-xrvm
• Ghost security advisories (43 GHSAs): https://github.com/TryGhost/Ghost/security/advisories
• Ghost release notes, v6.67.0: https://github.com/TryGhost/Ghost/releases/tag/v6.67.0

Transparency note

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.