This Metasploit module describes a critical Remote Code Execution (RCE) vulnerability affecting Ghost CMS, specifically versions from 0.7.2 up to and including 6.19.0. The exploit leverages specially crafted malicious themes to execute arbitrary code on the server hosting the CMS. This allows attackers to gain control over the underlying system, posing a significant threat to Ghost CMS installations.
The module also highlights a 2FA bypass vulnerability (CVE-2026-22594) affecting Ghost versions 5.105.0-5.130.5 and 6.0.0-6.10.3. This bypass simplifies authentication, making it easier for attackers to gain administrative access before deploying the malicious themes. The exploit offers various authentication methods, including password, API key, invitation flow, and session cookies, demonstrating its flexibility in different attack scenarios.
Discovered by Cristian-Alexandru Staicu and implemented as a Metasploit module by Maksim Rogov, this RCE allows for cross-platform exploitation on both Unix and Windows systems. The module includes robust cleanup procedures to revert changes and remove temporary artifacts, ensuring a clean exit post-exploitation.
Top comments (0)