CVE-2026-26980: Ghost CMS SQL injection in Content API

CVE-2026-26980 · Severity: critical · CVSS 9.4 · Published 2026-02-20

A security vulnerability has been identified in Ghost, a popular content management system used for professional publishing and blogs. This flaw allows an unauthorized person to send specially crafted requests to the site's public interface to read sensitive information directly from the database, including internal API keys. If exploited, an attacker could gain full access to site data or administrative credentials, potentially leading to a complete takeover of the website.

Technologies: ghost (npm). Vendors: npm.

Quick answers

Is CVE-2026-26980 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26980 being exploited in the wild.
How severe is CVE-2026-26980?
Critical severity, with a CVSS score of 9.4, published 20 February 2026.
Which products and versions are affected?
ghost (npm) >= 3.24.0, < 6.19.1, SEMVER:introduced=3.24.0,fixed=6.19.1.
Is there a fix for CVE-2026-26980?
Yes. ghost (npm): upgrade to 6.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26980 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-26980?
Check whether you run ghost (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ghost (npm): upgrade to 6.19.1 or later
    npm install ghost@6.19.1

Technical details

A SQL injection vulnerability exists in the Ghost Content API due to improper neutralization of user-supplied input in the 'slug' filter ordering logic. Specifically, the application was interpolating raw input into SQL 'CASE' statements within the 'autoOrder' function rather than using parameterized queries. An unauthenticated attacker can exploit this by sending a crafted query string containing malicious SQL syntax in the filter parameter. This allows for arbitrary database reads, which can be used to extract sensitive information such as staff API keys. The issue is fixed in version 6.19.1 by implementing parameterized query bindings.

Affected products

  • TryGhost Ghost 3.24.0 - 6.19.0

Identifiers

  • CVE-2026-26980
  • GHSA-w52v-v783-gw97

Timeline

  • 2026-02-16: patched: Fix committed and version 6.19.1 released.
  • 2026-02-18: disclosed: Public advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.