CVE-2026-103291: Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network endpoints to access metadata services and internal resources unavailable from the public internet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.51.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Ghost staff user can exploit it. The attacker needs permission to create or edit content containing image cards.
Are publicly accessible Ghost sites affected without login access?
The described attack requires authenticated staff access, so an unauthenticated public visitor is not described as able to directly trigger it. Exposure depends on whether staff accounts can be compromised or abused.
What can an attacker reach through the vulnerable server?
They can cause Ghost to make outbound HTTP requests to arbitrary URLs, including attacker-controlled hosts and internal network endpoints. This may expose metadata services and internal resources that are not reachable from the public internet.
Which versions need remediation?
Ghost versions from 3.20.2 before 6.51.0 are affected. Updating to 6.51.0 or later addresses the affected version range described here.