Junglewise Threat Intelligence

CVE-2026-26980: Ghost CMS SQL injection in Content API

CVE-2026-26980 · Severity: critical · CVSS 9.4 · Published 2026-02-20

Technologies: ghost (npm). Vendors: npm.

Executive brief

A security vulnerability has been identified in Ghost, a popular content management system used for professional publishing and blogs. This flaw allows an unauthorized person to send specially crafted requests to the site's public interface to read sensitive information directly from the database, including internal API keys. If exploited, an attacker could gain full access to site data or administrative credentials, potentially leading to a complete takeover of the website.

Technical details

A SQL injection vulnerability exists in the Ghost Content API due to improper neutralization of user-supplied input in the 'slug' filter ordering logic. Specifically, the application was interpolating raw input into SQL 'CASE' statements within the 'autoOrder' function rather than using parameterized queries. An unauthenticated attacker can exploit this by sending a crafted query string containing malicious SQL syntax in the filter parameter. This allows for arbitrary database reads, which can be used to extract sensitive information such as staff API keys. The issue is fixed in version 6.19.1 by implementing parameterized query bindings.

Affected products

  • TryGhost Ghost 3.24.0 - 6.19.0

Timeline

  • 2026-02-16: patched: Fix committed and version 6.19.1 released.
  • 2026-02-18: disclosed: Public advisory published.

References

Related threats