CVE-2026-70591: Ghost SSRF in Ghost Admin image fetching

Executive brief

Ghost, a popular open-source publishing platform, is affected by a security flaw in its administrative interface. An authorized staff member could potentially use the image fetching feature to scan the internal network for other active services or open ports. While the attacker cannot see the content of the internal data, this information could be used to plan further attacks against the organization's private infrastructure.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Ghost Admin component, specifically within the image fetching functionality. The flaw allows an authenticated user with at least 'staff' privileges to trigger blind HTTP GET requests from the server. While the application does not return the response body to the attacker, the behavior can be leveraged to perform internal port scanning and service discovery within the server's local network or VPC. The vulnerability is present in versions 0.10.0 through 6.54.0 and is addressed in version 6.54.1.

Affected products

• Ghost Foundation Ghost >= 0.10.0, < 6.54.1

Timeline

• 2026-07-30: patched: Fix released in version 6.54.1
• 2026-08-04: advisory: GitHub Advisory published

References

• https://api.github.com/users/koyokr
• https://github.com/koyokr
• https://api.github.com/users/koyokr/gists%7B/gist_id%7D
• https://api.github.com/users/koyokr/repos
• https://avatars.githubusercontent.com/u/20319256?v=4
• https://api.github.com/users/koyokr/events%7B/privacy%7D