A critical code injection vulnerability in the Ghost CMS allows attackers with administrative privileges to achieve remote code execution through malicious theme uploads.

This is an injection flaw (CWE-74) where the application improperly neutralizes special elements in theme files, allowing an authenticated administrator to execute arbitrary code on the underlying server.

The ability to execute arbitrary code on the server represents a total compromise of the application and potentially the hosting environment. Given the CVSS score of 7.6, this vulnerability poses a significant risk to data confidentiality, integrity, and availability, as an attacker could gain full control over the content management system.

Immediate Action: Update the Ghost installation to version 6.19.1 or later to apply the necessary security patches.

Proactive Monitoring: Monitor server access logs for suspicious file uploads or unexpected process execution originating from the theme directory.

Compensating Controls: Restrict administrative access to trusted personnel only and implement strict file integrity monitoring on the theme storage directory to detect unauthorized modifications.

Public Exploit Available: Yes, a Metasploit module exists for this vulnerability.

The severity of this remote code execution vulnerability cannot be overstated, as it provides a direct path for complete system takeover. Administrators should prioritize updating their Ghost instances to version 6.19.1 immediately and conduct a thorough audit of currently installed themes to ensure no malicious code has already been introduced.