This vulnerability is a Server‑Side Request Forgery in Ghost’s admin image‑fetching routine. Any staff‑level user can craft requests that cause Ghost to perform blind HTTP GETs against arbitrary internal hosts. Although no response is returned to the user, the vulnerability can be used to probe open ports and surface internal resources, serving as a foothold for further reconnaissance or lateral attacks. The weakness is tied to CWE‑918.

The issue affects Ghost installations from version 0.10.0 up to, but not including, 6.54.1. The affected product is Ghost, a Node.js‑based content management system. Users running any of these legacy versions should assess whether staff users could reach the Ghost admin interface.

The CVSS score of 4.1 indicates moderate risk, but the vulnerability’s exploitation requires only a staff‑level credential and can be performed with a simple HTTP request from the admin interface. There is no publicly available exploit code, and the vulnerability is not listed in the CISA KEV catalog, yet it still provides an internal reconnaissance vector that could aid an attacker prior to more serious exploits. Reducing exposure requires restricting internal host access from the Edge.