Description
Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.
Published: 2026-08-05
Score: 4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A validation flaw in Ghost allows an unauthenticated user to trigger a Server‑Side Request Forgery (CWE‑918) through Webmentions. The attacker can cause the Ghost server to make HTTP requests to hosts within the server’s internal network, but the response payload is suppressed. The vulnerability does not expose user data directly, yet it enables the server to reach internal services that could be further abused.

Affected Systems

TryGhost Ghost versions from 6.26.0 up through 6.54.1 are affected. The issue is resolved starting with 6.54.1; earlier releases remain vulnerable.

Risk and Exploitability

The CVSS score of 4.0 indicates low severity. EPSS is not available and the CVE is not listed in CISA KEV. The likely attack vector is via unauthenticated Webmention requests, which can reach internal network hosts but provide no direct response data, limiting exploit impact. Nonetheless, the ability to reach internal services presents a potential foothold for further lateral movement.

Generated by OpenCVE AI on August 5, 2026 at 16:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Ghost CMS to version 6.54.1 or later to eliminate the validation issue.
  • If an upgrade is not immediately feasible, disable the Webmentions feature or block the relevant endpoint so that unauthenticated requests cannot be processed.
  • Apply network controls to restrict outbound connections from the Ghost server to the internal network, ensuring that any remaining SSRF attempts cannot reach sensitive hosts.

Generated by OpenCVE AI on August 5, 2026 at 16:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-x5mm-wm4g-j5xv Ghost: Server-Side Request Forgery Mitigation Issue
History

Wed, 05 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.
Title Ghost: Server-Side Request Forgery Mitigation Issue
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-05T14:37:21.119Z

Reserved: 2026-08-04T19:50:27.328Z

Link: CVE-2026-70595

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T16:30:13Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)