Threat database

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.

Ghost versions from 3.10.0 up to but not including 6.34.0 have a vulnerability where sessions are not fully invalidated after a user changes their password. This allows an attacker with a stolen session cookie to maintain access to the user account despite the password change. The vulnerability has a high severity score of 7.6.

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through improper input validation.

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files.

Ghost versions from 5.42.2 up to but not including 6.58.0 have an information disclosure vulnerability in the Admin API's bulk post and page edit and delete endpoints. These endpoints improperly allow filtering on restricted fields such as authors.password due to an incomplete fix for a previous vulnerability (CVE-2026-70590). This flaw enables staff-level attackers to infer password hashes of other staff users, which can then be subjected to offline password-guessing attacks.

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings.

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level.

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.

Ghost versions from 4.0.0 up to but not including 6.63.0 have a vulnerability in the content API that allows unauthenticated users to access gated post content. This flaw enables attackers to bypass content restrictions by directly querying the API without authentication.

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content).

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and restore their original privileges.

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.

Ghost versions 5.2.0 through prior to 6.62.0 contain an authorization vulnerability allowing unauthenticated remote attackers to abuse the Stripe Checkout flow. This flaw permits attackers to attach paid subscriptions to existing members, modify member names, and inject content into newsletters. The injected content may lead to HTML injection or cross-site scripting (XSS) depending on the recipient's email client.

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.

Ghost, a Node.js content management system, has a server-side request forgery (SSRF) vulnerability affecting versions from 6.26.0 up to but not including 6.54.1. This flaw allowed unauthenticated users to abuse certain functionality, such as Webmentions, to make limited HTTP requests to internal hosts on the Ghost server's network. The vulnerability does not expose response data to the attacker. The issue is fixed in version 6.54.1.

Ghost, a Node.js content management system, had a session fixation vulnerability in its Admin interface from versions 2.2.0 up to but not including 6.54.1. The issue allowed existing sessions to remain valid upon login, potentially enabling session fixation attacks if combined with another vulnerability on the same domain. This vulnerability was fixed in version 6.54.1.

A path traversal vulnerability exists in TryGhost Ghost CMS versions from 0.10.0 up to but not including 6.54.1. This flaw allows a staff user to write files outside the intended uploads directory via custom theme uploads, potentially altering the installation's behavior. The issue is fixed in version 6.54.1.

Ghost, a Node.js content management system, contains a path traversal vulnerability in versions from 1.20.1 up to but not including 6.54.1. An administrator-level user could exploit this flaw by supplying a crafted database backup filename containing path separators, allowing remote overwriting of certain filesystem files. This vulnerability affects the integrity and availability of the system. The issue is fixed in version 6.54.1.

A Server-Side Request Forgery (SSRF) vulnerability exists in TryGhost Ghost versions from 0.10.0 up to but not including 6.54.1. This flaw allows any staff-level user to perform blind HTTP GET requests to internal hosts via the Ghost Admin image fetching functionality. Although no response data is returned, the vulnerability could be used to probe internal network ports. The issue is resolved in version 6.54.1.