CVE-2026-70591: Ghost: Server-Side Request Forgery in Image Fetching

Severity: medium (CVSS 4.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-04 · updated 2026-10-24
Weakness: CWE-918

Description

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.

Affected products

TryGhost Ghost: from 0.10.0, < 6.54.1

References

https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76

Get alerted when CVE-2026-70591 or the next vulnerability affects your stack