CVE-2026-53943
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Ghost is a Node.js content management system. In versions up to 6.37.0, when Ghost is behind a shared caching layer, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response.
Risk Assessment
In affected cache configurations, that response could be stored and served to subsequent visitors, allowing malicious content modifications. This could lead to takeover of staff user accounts if the frontend and admin panel are on the same domain.
Recommendation
It is recommended to upgrade to version 6.37.0 or later to mitigate this vulnerability. Additionally, consider separating the frontend and admin panel onto different domains for enhanced security.
Other vulnerabilities in Ghost CMS
See all- CVE-2026-26980Critical
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database.
- CVE-2023-40028Medium
Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability that allows authenticated users to upload files that are symlinks, which can lead to unauthorized reading of any files on the host operating system.
- CVE-2022-28397Critical
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. The vendor states that files can only be uploaded and published by trusted users, which is intentional.
- CVE-2026-53949Medium
In the Ghost content management system, from version 5.46.1 to 6.21.2, the validation applied to filters on public API endpoints could be partially bypassed, allowing the disclosure of private fields via a brute force attack. If SQLite was used, password hashes were fully accessible, while in the case of MySQL, the case of the password hashes was lost, potentially rendering further brute force attacks ineffective.
- CVE-2026-53948Medium
Ghost is a Node.js content management system. From versions 6.19.4 to 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served with an attacker-chosen content type from S3/GCS storage backends.
- CVE-2026-53946Medium
Ghost is a Node.js content management system. From versions 6.19.4 to 6.21.1, when re-rendering posts, Ghost could send HTTP requests to unauthorized image hosts, posing a security risk.
- CVE-2026-53945Medium
Ghost is a Node.js content management system. From versions 6.0.9 to 6.21.1, the private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks.
- CVE-2026-53944Medium
Ghost is a Node.js content management system. From versions 6.0.9 to 6.21.1, it is possible to bypass the IP filter when making an external request, allowing it to target an internal service using an IPv6 literal that maps to a private IPv4 address.
Original NVD description (English source)
Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the same page, allowing cache poisoning of request-specific preview output. When running Ghost's frontend and admin panel on the same domain this could be used to take over staff user accounts. When running these on different domains staff accounts have no exposure. This vulnerability is fixed in 6.37.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS