CVE-2026-53946 Details
Description
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.
A server-side request forgery (SSRF) vulnerability has been identified in Ghost, a Node.js content management system, affecting versions 6.19.4 prior to 6.21.1. When posts are re-rendered, Ghost attempts to retrieve missing image dimensions by sending an outbound HTTP request to the URL of the image card. This process lacks restrictions on which image hosts are considered trusted. As a result, an authenticated staff user with the ability to create or edit posts could direct an image card to a malicious host. This would cause the Ghost server to fetch the resource on their behalf, potentially accessing internal network resources or cloud metadata endpoints that are not publicly accessible.
Users can update to Ghost version 6.21.1, which addresses this vulnerability. For self-hosted Ghost instances using Docker, instructions for updating are available in the Ghost Docker documentation. For Ghost-CLI installations, refer to the Ghost update documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TryGhost/Ghost/security/advisories/GHSA-g366-23fw-ggp6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ghost | >= 6.19.4, < 6.21.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |