VulnerabilityDeferred

CVE-2026-70591

From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts.

MEDIUM 4.1EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.

CVSS 3.1: 4.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
EPSS: 0.23% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-918
Source: security-advisories@github.com

References

https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.