An unauthenticated attacker can exploit a SQL Injection flaw in Ghost’s Content API to read arbitrary database entries, compromising sensitive site information and user data. The vulnerability is formally classified as CWE‑89 and has a CVSS score of 9.4, indicating a high severity damage potential.

The flaw exists in Ghost, a Node.js content‑management system, across versions 3.24.0 through 6.19.0 inclusive. This includes all installations that have not applied the recent patch released in version 6.19.1.

With an EPSS score of 33% and no listing in the CISA KEV catalog, the risk to actively targeted systems remains significant. The likely attack path involves sending unauthenticated HTTP requests to the exposed Content API endpoint, enabling the attacker to execute arbitrary SELECT statements without credentials. Successful exploitation would allow data exfiltration, potentially exposing user accounts, content, and configuration details.