GHSA-vmc4-9828-r48r BIT-ghost-2026-22597 CVE-2026-22597
Ghost has SSRF via External Media Inliner
- Severity
- 0.0 / 10
- Low · CVSS 4.0
- Exploit chance (EPSS)
- 0.30%
- Chance of exploitation in the next 30 days. Higher than 22.46% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
6.11.0- Upgrade ghost to this version or later
Description
Impact
A vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF.
Vulnerable versions
This vulnerability is present in Ghost v5.38.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches
v5.130.6 and v6.11.0 contain a fix for this issue.
References
Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information
If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ghost npm → 6.11.0
- npm
npm install ghost@6.11.0- yarn
yarn add ghost@6.11.0- pnpm
pnpm add ghost@6.11.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- High
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- Low
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-x3mg-q38v-m562 Ghost: Authorization Issue Allowed Author Role to Delete any Post | Medium | Also affects ghost |
| GHSA-8575-cr6v-7jh4 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization | High | Also affects ghost |
| GHSA-r7f2-6fj8-6fg2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses | Medium | Also affects ghost |
| GHSA-322m-ff4g-9vx9 Ghost: Server-Side Request Forgery in Bookmark Fetching | Medium | Also affects ghost |
| GHSA-fwh9-qg68-vxp4 Ghost: Regular Expression Denial of Service in Content Import | Medium | Also affects ghost |
| GHSA-9m4w-fmjw-fvjq Ghost: Regular Expression Denial of Service in External Media Inliner | Medium | Also affects ghost |
| GHSA-hqq2-xqr2-fmx2 Ghost : Stored XSS via SVG Files in Content Imports | Medium | Also affects ghost |
| GHSA-69qc-f5m6-889c Ghost: Stored XSS via Embed Card Previews | High | Also affects ghost |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor