SB2026073059 - Multiple vulnerabilities in Ghost

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026073059

SB2026073059 - Multiple vulnerabilities in Ghost

Published: July 30, 2026

Security Bulletin ID SB2026073059
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 40% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-53945)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote attacker to access internal network hosts.

The vulnerability exists due to server-side request forgery in external request handling when issuing outbound HTTP requests. A remote attacker can supply a URL that leverages DNS rebinding to access internal network hosts.

The issue arises from a bypass of the private-IP check for outbound requests through features that issue external fetches.


2) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-53944)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to make server-side requests to internal services.

The vulnerability exists due to incomplete list of disallowed inputs in the external request IP filter when processing an IPv6 literal that maps to a private IPv4 address. A remote attacker can supply a crafted IPv6 literal to make server-side requests to internal services.


3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-53946)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to induce the server to send requests to unintended hosts and disclose limited sensitive information.

The vulnerability exists due to improper access control in the mobiledoc image-size fetch logic when re-rendering posts with image cards that reference user-supplied URLs. A remote user can create or edit a post containing a specially crafted image URL to induce the server to send requests to unintended hosts and disclose limited sensitive information.

The issue can be triggered during post re-rendering when image dimensions are missing, and user interaction is required.


4) Observable discrepancy (CVE-ID: CVE-2026-53947)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the members signin endpoints when handling magic link sign-in requests. A remote attacker can submit an email address to determine whether it belongs to a registered member to disclose sensitive information.


5) Input validation error (CVE-ID: CVE-2026-53948)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to facilitate stored cross-site scripting.

The vulnerability exists due to improper input validation in the Admin API file upload endpoint when processing uploaded files with a client-supplied Content-Type. A remote user can upload a file with a spoofed content type to facilitate stored cross-site scripting.

This issue affects installations using S3 or GCS storage backends and is exploitable on installations that serve uploaded files from the same origin as the site. User interaction is required to visit the uploaded content.


Remediation

Install update from vendor's website.

References