SB2026092473 - Multiple vulnerabilities in Ghost
Published: September 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Incomplete List of Disallowed Inputs (CVE-ID: N/A)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to make limited HTTP requests to hosts on the Ghost server's internal network.
The vulnerability exists due to incomplete disallowed-input filtering in Ghost private IP filtering when processing IPv6 transition addresses. A remote attacker can submit a request that uses an IPv6 transition address to make limited HTTP requests to hosts on the Ghost server's internal network.
No response data is returned by successful requests, and exploitation is possible only on some network configurations.
2) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a remote attacker to make limited HTTP requests to hosts on the Ghost server's internal network.
The vulnerability exists due to improper validation in bookmark-fetching functionality, such as Webmentions, when handling attacker-controlled URLs. A remote attacker can submit a crafted URL to make limited HTTP requests to hosts on the Ghost server's internal network.
No response data from the requested hosts is returned.
3) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary scripts in other staff users' admin sessions.
The vulnerability exists due to improper neutralization of input during web page generation in Ghost SVG media upload handling when uploading SVG media thumbnails or SVG images with a non-SVG file extension. A remote user can upload a crafted SVG file to execute arbitrary scripts in other staff users' admin sessions.
User interaction is required for the crafted content to be rendered.
Remediation
Install update from vendor's website.