CVE-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

CVE-2026-70592

Ghost is a Node.js content management system. In versions 1.20.1 through 6.54.1, an Administrator-level user could remotely overwrite certain filesystem files via the database backup filename because the database export endpoint did not reject path separators in the caller-supplied filename. This...

CVE-2026-70592

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

NPM: Ghost: Server-Side Request Forgery in Image Fetching

NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

ghost-blade (0.1.0), ohm (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2026-70591 via ghost (>=0.11.14, <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - sign-alex 1.0.1 Source cves: CVE-2026-70591 Source advisory: SNYK:JS-GHOST-18610058...

ghost-blade (0.1.0), ohm (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2026-70591 via ghost (>=0.11.14, <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - sign-alex 1.0.1 Source cves: CVE-2026-70591 Source advisory: OSV:GHSA-GCVV-72Q8-9V76...

Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

GHSA-GCVV-72Q8-9V76 Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

CVE-2026-70591

Ghost is a Node.js content management system. From version 0.10.0 up to 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET to internal hosts; no output was returned but it could be used to probe internal ports. The issue is...

CVE-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

CVE-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

GHSA-JM22-3W23-5Q7W Ghost: Blind Password Hash Disclosure in Ghost Admin API

Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions 6.54.1...

Ghost: Blind Password Hash Disclosure in Ghost Admin API

Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...

CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...

CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...

CVE-2026-70590

Ghost CMS (Node.js) prior to version 6.54.1 allowed staff-level users to leak other staff password hashes via the Ghost Admin API. The underlying issue is exposure of authentication data, enabling offline password guessing with potential account takeover; however, Device Verification was noted as...

EUVD-2026-39023

Ghost: Mobiledoc image-size fetch SSRF...

EUVD-2026-39024

Ghost: Server-side request forgery via DNS rebinding in external request handling...

CVE-2026-70588

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...