PT-2026-2219 · Ghost · Ghost

Odgrso · Published 2026-01-08 · Updated 2026-01-10 · CVE-2026-22597

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghost versions 5.38.0 through 5.130.5 Ghost versions 6.0.0 through 6.10.3

Description Ghost is a Node.js content management system. A flaw in Ghost’s media inliner mechanism enables staff users with a valid authentication token for the Ghost Admin API to extract data from internal systems through Server-Side Request Forgery (SSRF). SSRF occurs when a server is tricked into making requests to unintended locations, potentially exposing internal resources.

Recommendations Update to Ghost version 5.130.6 or later. Update to Ghost version 6.11.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-GHOST-2026-22597

CVE-2026-22597

GHSA-VMC4-9828-R48R

Affected Products

Ghost

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22597.json · Exploit
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-vmc4-9828-r48r · Vendor Advisory
• https://github.com/TryGhost/Ghost/commit/93add549ccf079d8e28bdb724fbb71a76942ff51 · Patch
• https://github.com/TryGhost/Ghost/commit/15d49131ff4aac3aca8642501c793f01f2bfcbb9 · Patch
• https://osv.dev/vulnerability/CVE-2026-22597 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vmc4-9828-r48r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22597 · Security Note
• https://github.com/TryGhost/Ghost · Note
• https://twitter.com/CVEnew/status/2009837425346908185 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009905117319880736 · Twitter Post
• https://t.me/CVEtracker/41907 · Telegram Post