Threat database

A Server-Side Request Forgery (SSRF) vulnerability exists in the TryGhost Ghost content management system versions 1.18.0 through 6.26.0. This vulnerability affects the webhooks feature and allows staff users to make requests to internal hosts from the Ghost server. The issue is resolved in version 6.27.0.

A missing authorization vulnerability in TryGhost Ghost allows users with the Author role to delete posts and pages they did not author. This issue affects Ghost versions from 5.81.0 up to but not including 6.60.0. The vulnerability has been fixed in version 6.60.0. The CVSS score is 6.5, indicating a medium severity impact primarily affecting availability. No known exploits are reported in the wild.

CVE-2026-105677 is a path traversal vulnerability in TryGhost Ghost that allows an authenticated Administrator to execute arbitrary code on the server via a crafted theme. The issue affects Ghost versions from 6.10.3 up to but not including 6.64.0. The vulnerability is fixed in version 6.64.0. This flaw arises from improper limitation of pathname to a restricted directory when loading theme translation files.

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.

Ghost versions from 4.39.0 up to but not including 6.64.0 have an information disclosure vulnerability in the Admin API. This flaw allows staff users with invite viewing permissions to see secret tokens of pending staff invites. Exploiting this, such users can accept pending invites for roles with higher privileges, leading to privilege escalation.

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.

Ghost versions from 0.5.0 up to but not including 6.64.0 contain an improper privilege management vulnerability. This flaw allows authenticated users with Editor or Super Editor roles to escalate privileges by assigning their own role to other staff members, despite lacking explicit permission. Specifically, Editors or Super Editors can promote Authors and Contributors to Editor or Super Editor roles.

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to compromise of a staff user's admin session when that user views the affected page.

Ghost versions from 3.20.2 up to but not including 6.51.0 have a server-side request forgery (SSRF) vulnerability in the image dimension refetching feature. This flaw allows authenticated staff users to make the server send HTTP requests to arbitrary URLs, potentially accessing internal network resources or metadata services not exposed publicly.

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.

Ghost versions 1.18.0 up to but not including 6.27.0 have a server-side request forgery (SSRF) vulnerability in the webhooks feature. This flaw allows attackers with staff privileges to make the Ghost server send crafted requests to internal network hosts, potentially probing internal resources. The vulnerability requires staff-level access to exploit and does not involve user interaction.

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated privileges without proper authorization checks.

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when visited by authenticated members without their knowledge or consent.

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without proper authorization checks.