PT-2026-20787 · Ghost · Ghost

Nicholas Carlini · Published 2026-02-18 · Updated 2026-04-19 · CVE-2026-26980

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Ghost versions 3.24.0 through 6.19.0

Description Ghost is a Node.js content management system. A blind SQL injection exists in the Content API, specifically within the '/ghost/api/content' endpoint. This flaw allows unauthenticated attackers to perform arbitrary reads from the database, which can lead to the theft of admin API keys and full administrative account takeover.

Recommendations Update to version 6.19.1. As a temporary mitigation, use a reverse proxy or WAF rule to block Content API requests containing slug%3A%5B or slug:[ in the query string filter parameter.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-GHOST-2026-26980

CVE-2026-26980

GHSA-W52V-V783-GW97

Affected Products

Ghost

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26980.json · Exploit
• https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91 · Patch
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ghost-2026-26980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26980 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26980 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w52v-v783-gw97 · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://github.com/TryGhost/Ghost/releases/tag/v6.19.1 · Note
• https://twitter.com/cracbot/status/2026613205787914617 · Twitter Post
• https://twitter.com/grok/status/2039326247554048131 · Twitter Post
• https://twitter.com/labinvisiblecom/status/2045875357161853073 · Twitter Post
• https://twitter.com/psyciclabs/status/2038561135545507882 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024699320897777843 · Twitter Post
• https://twitter.com/CveTodo/status/2024672495140208786 · Twitter Post