Junglewise Threat Intelligence

CVE-2026-53946: TryGhost Ghost SSRF in image-size fetch

CVE-2026-53946 · Severity: medium · CVSS 5.4 · Published 2026-06-24

Technologies: ghost (npm). Vendors: npm.

Executive brief

Ghost, a popular content management system, is affected by a security flaw that allows authorized staff members to trick the server into making unauthorized network requests. By creating or editing a post with a specially crafted image link, an attacker can force the server to connect to internal systems or cloud metadata services that are not intended to be public. This could lead to the exposure of sensitive internal configuration data or credentials, potentially compromising the underlying hosting environment.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Ghost's Mobiledoc image-size fetching logic. When re-rendering posts, the application attempts to fetch missing image dimensions by issuing outbound HTTP requests to URLs provided in image cards without validating the destination. An authenticated staff user with post-editing privileges can provide a malicious URL pointing to internal network resources or cloud instance metadata endpoints (e.g., 169.254.169.254). This allows the attacker to bypass network boundaries and potentially retrieve sensitive information from the local environment. The issue is fixed in version 6.21.1 by restricting image size fetching to internal/trusted images only.

Affected products

  • TryGhost Ghost >= 6.19.3, < 6.21.1

Timeline

  • 2026-03-10: patched: Fix merged into main branch via PR #26753
  • 2026-06-10: disclosed: Initial advisory publication
  • 2026-06-24: advisory: NVD published CVE-2026-53946
  • 2026-08-04: advisory: GitHub Advisory updated

References

Related threats