CVE-2024-23724
Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
- Record
CVE-2024-23724- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
- Record
CVE-2024-23724- Updated
- 2026-11-02
EUVDEUVD-2024-0591 No score
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
- Record
EUVD-2024-0591- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-99vc-xw8j-phjm
Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
- Record
GHSA-99vc-xw8j-phjm- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-99vc-xw8j-phjm
Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
- Record
GHSA-99vc-xw8j-phjm- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-ghost-2024-23724 No score
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
- Record
BIT-ghost-2024-23724- Updated
- 2026-11-02
OSV No score
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
- Record
CVE-2024-23724- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Youssefdds/CVE-2024-23724 | 2025-01-19 |
| PoC in GitHub | gl1tch0x1/Ghost-CMS-Exploit | 2025-02-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-23724 is a critical vulnerability (CVSS 9.0) in Ghost, published February 11, 2024. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.48%, the 89th percentile. Fixed in ghost 5.82.11.
References
rhinosecuritylabs.com/blog
github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2024-23724
nvd.nist.gov/vuln/detail/CVE-2024-23724