CVE-2026-70591

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.

CVSS v3 4.1 MEDIUM

4.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Ghost es un sistema de gestión de contenido Node.js. Desde 0.10.0 hasta 6.54.1, una falsificación de petición del lado del servidor en la obtención de imágenes de Ghost Admin permitía a cualquier usuario con nivel de personal realizar una petición HTTP GET ciega contra hosts internos. No se devolvía ninguna salida, pero esto podría haberse utilizado para sondear puertos abiertos en hosts internos. Este problema está solucionado en la versión 6.54.1.

Information

Published : 2026-08-04 22:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-70591

Mitre link : CVE-2026-70591

CVE.ORG link : CVE-2026-70591

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-70591", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70591", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T14:14:58.079494Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "TryGhost", "product": "Ghost", "versions": [{"status": "affected", "version": ">= 0.10.0, < 6.54.1"}]}]}], "published": "2026-08-04T22:17:16.997", "references": [{"url": "https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e", "source": "security-advisories@github.com"}, {"url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1."}, {"lang": "es", "value": "Ghost es un sistema de gesti\u00f3n de contenido Node.js. Desde 0.10.0 hasta 6.54.1, una falsificaci\u00f3n de petici\u00f3n del lado del servidor en la obtenci\u00f3n de im\u00e1genes de Ghost Admin permit\u00eda a cualquier usuario con nivel de personal realizar una petici\u00f3n HTTP GET ciega contra hosts internos. No se devolv\u00eda ninguna salida, pero esto podr\u00eda haberse utilizado para sondear puertos abiertos en hosts internos. Este problema est\u00e1 solucionado en la versi\u00f3n 6.54.1."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}