CVE-2026-53946
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Ghost is a Node.js content management system. From versions 6.19.4 to 6.21.1, when re-rendering posts, Ghost could send HTTP requests to unauthorized image hosts, posing a security risk.
Risk Assessment
The threat is that an authenticated user could direct a request to a malicious host, potentially exposing data from internal networks or cloud metadata endpoints.
Recommendation
It is recommended to update Ghost to version 6.21.1 to mitigate this vulnerability and restrict post editing access to trusted users.
Other vulnerabilities in Ghost CMS
See all- CVE-2026-53943Critical
Ghost is a Node.js content management system. In versions up to 6.37.0, when Ghost is behind a shared caching layer, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response.
- CVE-2026-26980Critical
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database.
- CVE-2023-40028Medium
Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability that allows authenticated users to upload files that are symlinks, which can lead to unauthorized reading of any files on the host operating system.
- CVE-2022-28397Critical
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. The vendor states that files can only be uploaded and published by trusted users, which is intentional.
- CVE-2026-53949Medium
In the Ghost content management system, from version 5.46.1 to 6.21.2, the validation applied to filters on public API endpoints could be partially bypassed, allowing the disclosure of private fields via a brute force attack. If SQLite was used, password hashes were fully accessible, while in the case of MySQL, the case of the password hashes was lost, potentially rendering further brute force attacks ineffective.
- CVE-2026-53948Medium
Ghost is a Node.js content management system. From versions 6.19.4 to 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served with an attacker-chosen content type from S3/GCS storage backends.
- CVE-2026-53945Medium
Ghost is a Node.js content management system. From versions 6.0.9 to 6.21.1, the private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks.
- CVE-2026-53944Medium
Ghost is a Node.js content management system. From versions 6.0.9 to 6.21.1, it is possible to bypass the IP filter when making an external request, allowing it to target an internal service using an IPv6 literal that maps to a private IPv4 address.
Original NVD description (English source)
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.