CVE-2026-53946 json
Ghost: Mobiledoc image-size fetch SSRF
published 4mo ago modified 17d ago also BIT-ghost-2026-53946 , EUVD-2026-39023 , GHSA-g366-23fw-ggp6
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.
Patch / fix
- npm ghost 6.21.2
- bitnami ghost 6.21.1
- ghost ghost 6.21.1
- github.com/TryGhost/Ghost@ba692df commit
- github.com/TryGhost/Ghost#26753 pull request
- github.com/TryGhost/Ghost/releases/tag/v6.21.1 release
Is CVE-2026-53946 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ghost | >=6.19.4, <6.21.2 |
6.21.2 |
| bitnami | ghost | >=6.19.4, <6.21.1 |
6.21.1 |
Affected products
- TryGhost Ghost
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/TryGhost/Ghost/pull/26753
web
-
github.com
/TryGhost/Ghost/commit/ba692df7f27162d0440d57487f16c530416a8eb2
web
-
github.com
/TryGhost/Ghost/security/advisories/GHSA-g366-23fw-ggp6
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-53946
advisory, web
-
github.com
/TryGhost/Ghost
package
-
github.com
/TryGhost/Ghost/releases/tag/v6.21.1
web
Sources
- CVE List CVE-2026-53946
- GitHub Advisory GHSA-g366-23fw-ggp6
- NVD CVE-2026-53946
- OSV BIT-ghost-2026-53946
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.