DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-105646: CVE-2026-105646: Regular Expression Denial of Service in Ghost CMS Import Handlers

#security #cve #cybersecurity

CVE-2026-105646: Regular Expression Denial of Service in Ghost CMS Import Handlers

Vulnerability ID: CVE-2026-105646
CVSS Score: 4.9
Published: 2026-10-07

An authenticated Regular Expression Denial of Service (ReDoS) vulnerability in TryGhost Ghost (CMS) versions 4.0.0 through 6.66.x. An attacker with administrator privileges can upload crafted content import archives containing pathological directory names or migration patterns, triggering exponential backtracking in the Node.js V8 engine.

TL;DR

Ghost CMS is vulnerable to a Regular Expression Denial of Service (ReDoS) in its import and migration handlers. Authenticated administrators can cause high CPU utilization and freeze the Node.js event loop by importing directories named with pathological regular expressions or configuring complex migration domain wildcards.

Technical Details

  • CWE ID: CWE-1333
  • Attack Vector: Network (AV:N)
  • CVSS: 4.9 (Medium)
  • EPSS: 0.00327
  • Impact: Denial of Service (DoS)
  • Exploit Status: PoC
  • KEV Status: Not Listed

Affected Systems

  • TryGhost Ghost CMS
  • Ghost: >= 4.0.0, < 6.67.0 (Fixed in: 6.67.0)

Code Analysis

Commit: 88ae6d6

Escape user-controlled inputs in dynamic RegExp constructors and introduce sandboxed VM executions with a timeout to counter ReDoS paths.

Mitigation Strategies

  • Upgrade Ghost CMS to version 6.67.0 or above to apply Lodash input escaping and VM execution boundaries.
  • Enforce Least Privilege access controls on the administrative dashboard, limiting the creation of Administrator-level accounts.
  • Deploy custom Web Application Firewall (WAF) filter signatures to reject payloads with directory paths containing nested regular expression indicators.

Remediation Steps:

  1. Access the host machine or container where the Ghost service is deployed.
  2. Verify the current version of Ghost by executing: ghost status
  3. Execute the update procedure using the administrative tool: ghost update
  4. Confirm the migration scripts completed successfully and verify services are running on version 6.67.0 or later.

References

Read the full report for CVE-2026-105646 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)