See how ghost compares to other vendors in security performance
Impact
The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content.
Vulnerable versions
This vulnerability is present in Ghost from v5.26.0 up to v6.54.0.
Patches
v6.54.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Workarounds
If upgrading immediately is not possible, avoid using the Universal Import feature.
References
Ghost thanks meifukun for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxyaddxforwardedfor directive to present an arbitrary IP address, circumventing Ghost's rate-limiting mechanisms on self-hosted instances.
Impact
When Ghost is behind a shared caching layer that results in cached content being shared between different visitors (e.g., Fastly, Cloudflare, nginx proxycache, and others), an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the same page, allowing cache poisoning of request-specific preview output.
When running Ghost's frontend and admin panel on the same domain this could be used to take over staff user accounts. When running these on different domains staff accounts have no exposure.
Vulnerable versions
This vulnerability is present in Ghost from v4.0 up to v6.36.0.
Patches
v6.37.0 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
If you suspect a credential compromise, use the “Reset all authentication” dialogue under Settings / Danger Zone. This is available starting with Ghost v6.41.0.
Workarounds
At the caching layer, bypass the cache for x-ghost-preview requests.
References
Ghost thanks CryptoCat for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Impact
When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet.
Vulnerable versions
This vulnerability is present in Ghost from v6.19.3 up to v6.21.0.
Patches
v6.21.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Impact
A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site.
Vulnerable versions
This vulnerability is present in Ghost from v5.18.0 up to v6.21.0.
Patches
v6.21.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact
Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff.
Vulnerable versions
This vulnerability is present in Ghost from v6.19.4 up to v6.21.0.
Patches
v6.21.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Impact
The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless.
Vulnerable versions
This vulnerability is present in Ghost from v5.46.1 up to v6.21.1.
Patches
v6.21.2 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Workarounds
If upgrading immediately is not possible, block or filter requests to Content API endpoints where the filter query parameter contains password or email (including any compound form such as users.password, users.email, authors.password, authors.email). Reject requests at a reverse proxy / WAF layer before they reach Ghost.
Example (case-insensitive) pattern to block on the raw querystring:
filter=[^&](password|email)
References
Ghost thanks crnkovic for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
A critical SQL injection flaw in Ghost CMS (CVE-2026-26980, CVSS 9.4) has been actively exploited since May 7 to compromise over 700 public websites. The vulnerability was discovered by Anthropic using Claude and patched in February in version 6.19.1. A lot of sites are still running unpatched versions. Here's what attackers are doing with it. The flaw lets anyone pull a Ghost site's admin API key without authenticating. With that key they can call the admin API directly and modify every published article on the site in bulk. Attackers have been using this to inject malicious JavaScript loaders at the bottom of articles across hundreds of sites. When a real visitor lands on one of these compromised pages, the injected code serves them a fake CAPTCHA prompt. It looks like a standard human verification check. The prompt tells them to copy a command and paste it into the Windows Run dialog to prove they are human. Running that command installs malware. The compromised sites include universities, AI companies, SaaS platforms, fintech companies, and security research firms. The legitimacy of those domains is exactly what makes the attack effective. If you run Ghost CMS, here is what to do right now. Update to version 6.19.1 or later, rotate your admin API key and all credentials, open your published articles and check the bottom of the content for any script tags you did not add, and review your server access logs for unusual activity since May 7. If you find evidence of compromise, notify users who visited during that window. For anyone visiting websites generally, if a CAPTCHA ever asks you to copy something and paste it into a Run dialog or terminal, that is malware. Close the tab.
Impact
Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site.
Vulnerable versions
This vulnerability is present in Ghost from v5.101.6 up to v6.19.2.
Patches
v6.19.3 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here.
For more information
If there are any questions or comments about this advisory, send an email to security@ghost.org.
Impact
Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.
Vulnerable Versions
This vulnerability is present in Ghost v0.7.2 to v6.19.0.
Patches
v6.19.1 contains a fix for this issue.
Workarounds
Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific.
References Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly.
For more information
If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact
A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database.
Vulnerable Versions
This vulnerability is present in Ghost v3.24.0 to v6.19.0.
Patches
v6.19.1 contains a fix for this issue.
Workarounds
There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability.
As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing slug%3A%5B or slug:[ in the query string filter parameter. Note that this may break legitimate slug filter functionality.
References
We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly.
For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Impact An attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover.
Vulnerable versions This vulnerability is present in Ghost versions: - v5.43.0 to v5.120.4 - v6.0.0 to v6.14.0
As well as in Portal versions: - v2.29.1 to v2.51.4 - v2.52.0 to v2.57.0
Patches Ghost automatically loads the latest patch of the members Portal component via CDN. Therefore: - For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability (loads Portal v2.51.5, which contains the patch) - For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability (loads Portal v2.57.1, which contains the patch)
For Ghost installations using a customised or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version.
References Ghost thanks Younes Belalia for discovering and disclosing this vulnerability responsibly.
For more information If users have any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact A vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL.
Vulnerable versions This vulnerability is present in Ghost v5.90.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches v5.130.6 and v6.11.0 contain a fix for this issue.
References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact A vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF.
Vulnerable versions This vulnerability is present in Ghost v5.38.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches v5.130.6 and v6.11.0 contain a fix for this issue.
References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact A vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints.
Vulnerable versions This vulnerability is present in Ghost v5.121.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches v5.130.6 and v6.11.0 contain a fix for this issue.
References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact A vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA.
Vulnerable versions This vulnerability is present in Ghost v5.105.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches v5.130.6 and v6.11.0 contain a fix for this issue.
References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact
A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF.
Vulnerable versions
This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8.
Patches
v5.130.4 and v6.0.9 contain a fix for this issue.
References
The original report is available here: https://fluidattacks.com/advisories/regida
We thank Cristian Vargas for discovering and disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Impact
Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.
Vulnerable versions
This security vulnerability is present in Ghost v4.46.0-v5.89.5.
Ghost(Pro) customers are automatically updated to fixed versions ahead of disclosure.
If you're a self-hoster, please follow our update instructions.
Patches
v5.89.5 contains a fix for this issue.
Workarounds
Disable site membership in Ghost settings.
For more information
If you have any questions or comments about this advisory:
Email us at security@ghost.org
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.
Ghost before 5.82.0 allows CSV Injection during a member CSV export.
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.
Impact
A vulnerability in Ghost allows authenticated users to upload files which are symlinks. This can be exploited to perform an arbitrary file read of any file on the operating system.
Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder
Vulnerable versions
This security vulnerability is present in Ghost ≤ v5.59.0.
Patches
v5.59.1 contains a fix for this issue.
For more information
If you have any questions or comments about this advisory: Email us at security@ghost.org
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
Impact
Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.
Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.
Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below.
Patches
v5.46.1 contains a fix for this issue.
Workarounds
Add a block for requests to /ghost/api/content/ where the filter query parameter contains password or email.
For more information
If you have any questions or comments about this advisory:
Email us at security@ghost.org
Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no security impact.
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the codeinjectionfoot for a post.