CVE-2026-26980: Ghost has a SQL Injection in its Content API

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 71.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-20 · updated 2026-06-17
Weakness: CWE-89

Description

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

Affected products

TryGhost Ghost: from 3.24.0 before 6.19.1 — fixed in 6.19.1

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.19.1. Check the vendor advisory for mitigations.

References

https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91
https://github.com/TryGhost/Ghost/releases/tag/v6.19.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97
https://blog.xlab.qianxin.com/ghost-cms-page-poisoning-cve-2026-26980/

Get alerted when CVE-2026-26980 or the next vulnerability affects your stack