Ghost CVE-2026-105644: SVG imports can put admin sessions at risk

CVE-2026-105644, published on 5 October, covers Ghost, a Node.js publishing platform. The record identifies versions from 4.0.0 up to, but excluding, 6.67.0, with a fix in 6.67.0. SVG images included in content imports were stored without sanitisation.

The vendor advisory dated 1 October requires persuading an administrator to import a file. Scripts on the site’s domain can threaten staff admin sessions. The record alone does not establish an attack on a particular site.

Who should assess exposure

Teams operating Ghost and people responsible for migrations, imports and material from external suppliers should review their deployment. Establish the running version, who can import data and which archives were accepted during the period under assessment.

The advisory’s table and CVE record give 6.67.0 as the boundary, although the narrative ends the range at 6.65.0. We do not treat this discrepancy as proof that 6.66.x is safe: choose a release containing the fix.

Importing content crosses a trust boundary

Breachroad recommends avoiding automatic trust in archive contents merely because an administrator approved the import. An archive can carry images, links and active elements; checking post titles is not a complete assessment of those components.

In the updated importer implementation, images are checked before further processing and SVG or SVGZ files go through sanitisation. Assess upload and import paths separately in your own process. Verification of one does not establish protection of the other.

An action plan for administrators and editorial teams

1. Confirm the version. Check the running instance, image and recovery configuration. The ticket should identify the update owner and evidence required to confirm completion.
2. Deploy a fixed release. Plan an upgrade to a supported version containing the 6.67.0 fix, following the organisation’s installation method and backup procedure.
3. Define archive acceptance. Establish the source, expected contents and approver. Refer suspicious files for assessment in an isolated environment first.
4. Verify import handling. Use reference material without real data or a production session. Check the result of SVG handling rather than relying on an import-success message.
5. Review earlier imports. If a malicious import is suspected, preserve the material and review relevant assets and account activity. Make session invalidation and credential-replacement decisions through the incident process.

These are our operational recommendations. Correct handling of a new import does not, by itself, answer questions about earlier material. Reports should distinguish the current remediation state from an assessment of possible past compromise.

Training scenario: a partner’s archive

In our fictional scenario, an editorial team receives a ready-made blog export. The supplier asks for a quick import before launch. An administrator sees familiar titles and a few image files, so treats the package as routine.

The exercise asks participants to identify three decisions: who confirms the archive’s origin, where its contents are assessed and which evidence is needed before a production import. It does not require opening a suspicious SVG in a browser signed into the admin panel. Deadline pressure should trigger the established escalation route rather than skipped checks.

Cybersecurity training for IT and editorial teams helps staff rehearse these decisions and report concerns. Our guide to secure file uploads explains the technical foundations.

Sources and Breachroad conclusions

Dates, versions and the mechanism come from the CVE record and Ghost advisory. The linked implementation confirms changes to imported-image handling. The response plan and editorial scenario are Breachroad recommendations. An older installation alone does not establish that an admin session was compromised.