Ghost CMS EUVD-2026-39023

Exploitation requires a valid Ghost staff user account with post creation or editing permissions - unauthenticated exploitation is not possible. The flaw is triggered during post re-rendering when an image card URL is present and Ghost lacks cached dimension data for that URL, causing Ghost to fetch the URL. The attacker must control the image card URL value within the post content. Exploitation is limited to Ghost versions 6.19.4 through 6.21.1. The UI:R CVSS metric indicates a re-rendering event must be triggered, meaning the attacker cannot autonomously force the server request without some post save or render action. Access to the Ghost admin interface or API is required; the vulnerability does not affect unauthenticated readers of published content.

The vendor-assigned CVSS 3.1 score of 5.4 (Medium) reflects low complexity, authenticated access (PR:L), a scope change (S:C - Ghost's rendering pipeline affects external systems on the server's behalf), and low individual C/I impact. The UI:R metric warrants scrutiny: it suggests some triggering action is needed to initiate re-rendering, which limits opportunistic mass exploitation but does not materially hinder a motivated insider or compromised staff account. Despite the medium score, real-world risk is asymmetric for cloud-hosted Ghost instances: if IMDSv2 is not enforced with a hop-limit of 1, an attacker reaching the AWS or GCP metadata endpoint via SSRF may obtain instance credentials, escalating impact well beyond what the base CVSS score implies. KEV status is absent - no confirmed active exploitation. EPSS data was not included in available intelligence and cannot be quantified. No POC is referenced. The risk profile is therefore: medium baseline, high potential for cloud-deployed instances without metadata service hardening.

An authenticated Ghost staff member inserts an image card into a post with the URL set to an internal target - for example, http://169.254.169.254/latest/meta-data/iam/security-credentials/ on an AWS-hosted instance - then saves or triggers re-rendering of the post. Ghost's rendering pipeline, finding no cached image dimensions, issues an outbound GET request to that URL, and the HTTP response (potentially containing cloud IAM credentials) is processed server-side. No public POC exists at time of analysis, but the SSRF technique against cloud metadata endpoints is well-documented and requires no specialized tooling beyond the ability to set an image card URL.