PT-2026-2218 · Ghost · Ghost

Odgrso · Published 2026-01-08 · Updated 2026-01-13 · CVE-2026-22596

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghost versions 5.90.0 through 5.130.5 Ghost versions 6.0.0 through 6.10.3

Description Ghost is a Node.js content management system. A flaw in the /ghost/api/admin/members/events API endpoint permits authenticated Admin API users to execute arbitrary SQL queries. The vulnerability exists due to insufficient input validation when processing requests to this endpoint. The admin role is required for exploitation.

Recommendations Update to Ghost version 5.130.6 or later. Update to Ghost version 6.11.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-GHOST-2026-22596

CVE-2026-22596

GHSA-GJRP-XGMH-X9QQ

Affected Products

Ghost

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22596.json · Exploit
• https://github.com/TryGhost/Ghost/commit/cda236e455a7a30e828b6cba3c430e5796ded955 · Patch
• https://github.com/TryGhost/Ghost/commit/f2165f968bcdaae0e35590b38fa280ab03239391 · Patch
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-gjrp-xgmh-x9qq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22596 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22596 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gjrp-xgmh-x9qq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ghost-2026-22596 · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://twitter.com/CVEnew/status/2009837426433204551 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009912796276797746 · Twitter Post