A flaw in Ghost’s Content API allows an attacker to inject arbitrary SQL that reads sensitive data from the database. The vulnerability is formalized as CWE‑89 and carries a CVSS score of 9.4, emphasizing a severe impact on database confidentiality.

Versions 3.24.0 through 6.19.0 of the Ghost Node.js content‑management system are vulnerable. The fix is provided in version 6.19.1 and later; any installation that has not applied this patch remains at risk.

The EPSS score of 57% indicates a substantial likelihood that attackers will target this weakness. The CVSS score of 9.4 highlights a severe impact on confidentiality, making any successful exploitation highly damaging. Based on the description, the likely attack path involves sending unauthenticated HTTP requests to the exposed Content API endpoint, which is inferred from the available data. Successful exploitation would permit an eavesdropper to retrieve arbitrary database content, exposing user accounts, posts, and configuration information. The vulnerability is not listed in the CISA KEV catalog, so it is not confirmed for exploitation in active campaigns, but the combined severity and exploit potential warrant prompt remediation.