Ghost 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3 allow a staff user who holds a valid authentication token for the Ghost Admin API to craft media requests that the server will forward to arbitrary URLs. This Server‑Side Request Forgery enables the attacker to read data from internal network hosts or servers that would otherwise be unreachable from the Internet, thereby compromising confidentiality of internal resources.

TryGhost Ghost content management system is affected. The vulnerability exists in all releases from 5.38.0 up to and including 5.130.5 and from 6.0.0 up to 6.10.3. The issue was fixed in Ghost 5.130.6 and 6.11.0.

The base CVSS score is 5.1, indicating moderate severity. EPSS is below 1 %, suggesting a low probability that the vulnerability is actively exploited, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an API request that includes a media URL, leveraging a stolen or compromised staff API token. Exploitability requires the attacker to obtain a valid token, after which the SSRF can be used to exfiltrate internal data with relative ease. The overall risk remains moderate, but the low exploitation probability mitigates the urgency somewhat.