SSRF Vulnerability in Ghost Content Management System Affects Authentication Tokens
CVE-2026-22597
5.1MEDIUM
What is CVE-2026-22597?
A security issue has been identified in the Ghost content management system where the media inliner mechanism is susceptible to Server-Side Request Forgery (SSRF). This vulnerability permits authenticated staff users with valid tokens for the Ghost Admin API to potentially exfiltrate sensitive data from the internal systems. The affected versions span from 5.38.0 to 5.130.5 and 6.0.0 to 6.10.3, and users are urged to upgrade to versions 5.130.6 or 6.11.0 to mitigate this risk.
Affected Version(s)
Ghost >= 6.0.0, < 6.11.0 < 6.0.0, 6.11.0
Ghost >= 5.38.0, < 5.130.6 < 5.38.0, 5.130.6