Servers and applications
GHSA-86pw-gh6f-cpmg
Media Thumbnail Overwrite by Contributors
- Severity
- Medium 4.3
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 6.76.0
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Change some data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N- Sources
- Project advisories (GitHub)
Description
Any staff user, including a Contributor, could replace the thumbnail image of video or other media uploaded by another user, including on published posts they cannot edit. The replacement image would then appear on the published post.
The impact is limited to replacing media thumbnail images. It does not give access to other files and does not allow editing post content.
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Affected software
| Software | Affected versions |
|---|---|
GhostServers and applications · github:tryghost/ghost |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-86pw-gh6f-cpmg
- github.com https://github.com/TryGhost/Ghost/security/advisories/GHSA-86pw-gh6f-cpmg