EUVD-2026-39023
GHSA-g366-23fw-ggp6
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Staff authentication required (PR:L), re-render event needed to trigger fetch (UI:R), and Ghost's server crosses trust boundary to reach internal systems (S:C).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card - without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.
AnalysisAI
Server-side request forgery in Ghost CMS versions 6.19.4 through 6.21.1 allows authenticated staff users to pivot the Ghost server into making arbitrary outbound HTTP requests, including to internal network hosts and cloud instance metadata endpoints. The vulnerable code path is Ghost's post re-rendering pipeline, which fetches image dimensions from URLs stored in image cards without validating those URLs against a trusted host allowlist. No public exploit has been identified at time of analysis, and a vendor-released patch is available in 6.21.1.
Technical ContextAI
Ghost is an open-source Node.js content management platform used widely for publishing and blogging. The affected mechanism is Ghost's image card processing: during post re-rendering, when cached image dimension data is absent, Ghost issues an outbound HTTP GET request to the URL embedded in the image card to retrieve those dimensions. CWE-918 (Server-Side Request Forgery) identifies the root cause as the absence of URL validation or an outbound request allowlist on this code path. The SSRF is functionally unrestricted - the Ghost server can be directed at RFC 1918 addresses, loopback interfaces, or cloud metadata services such as the AWS IMDSv1 endpoint (169.254.169.254), which are reachable from the host but not from the public internet. CPE cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:* confirms the affected product scope.
RemediationAI
The primary fix is upgrading Ghost to version 6.21.1 or later, which introduces trusted host restrictions on outbound HTTP requests issued during image dimension fetching. The vendor advisory is at https://github.com/TryGhost/Ghost/security/advisories/GHSA-g366-23fw-ggp6. If immediate patching is not possible, restrict which users hold staff-level post creation and editing permissions, reducing the pool of accounts that can inject malicious image card URLs. As a network-level compensating control, configure host-based or perimeter firewall rules to block egress from the Ghost process to RFC 1918 address ranges and to 169.254.169.254 (AWS/GCP/Azure metadata); note this may break legitimate integrations that require intranet access. For cloud-hosted instances, enforce IMDSv2 with a PUT hop-limit of 1 on the instance to prevent single-hop SSRF from reaching instance metadata - this is a meaningful compensating control but does not address SSRF to other internal hosts and is not a substitute for patching.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today