Executive brief
Ghost is a popular content management system and blogging platform. A SQL injection vulnerability in Ghost's admin API members events endpoint allows authenticated administrators to execute arbitrary database queries, potentially exposing or modifying member data and other sensitive information stored in the database.
Technical details
The vulnerability is a SQL injection (CWE-89) in Ghost's /ghost/api/admin/members/events endpoint. The flaw allows users with valid Admin API credentials to inject arbitrary SQL commands through insufficiently sanitized input parameters. The attack vector is network-based and requires high privileges (Admin API authentication); no user interaction is needed. An attacker with admin credentials can read, modify, or delete database records. Patches are available in Ghost v5.130.6 and v6.11.0.
Affected products
- Ghost Ghost 5.90.0 to 5.130.5, 6.0.0 to 6.10.3
Timeline
- 2026-01-08: disclosed: Vulnerability published
- 2026-01-08: patched: Patches released: Ghost v5.130.6 and v6.11.0