Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
56 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete. Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. Patches v6.44.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Adel Assakaf and Arthur Gurunlian as well as Geoffrey Diederichs of Escape for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at…
Recommended action: Upgrade to 6.44.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. Vulnerable versions This vulnerability is present in Ghost from v6.56.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References We thank Rafael B. for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.67.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session. Self-hosted sites should leave the new security.embedPreviewUrl config option at its default. Vulnerable versions This vulnerability is present in Ghost from v6.34.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks DONG2209 (Dong Nguyen) and Pedro Pinho for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.67.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. Vulnerable versions This vulnerability is present in Ghost from v4.0.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Zhixi "Jace" Sun, independent security researcher, for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.67.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v5.37.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks ka3n1x for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.67.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v4.0.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks ka3n1x for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.67.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. Vulnerable versions This vulnerability is present in Ghost from v6.54.1 up to v6.64.0. Patches v6.65.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Nhat Anh Vu for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.65.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. Vulnerable versions This vulnerability is present in Ghost from v6.0.9 up to v6.64.0. Patches v6.65.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Nhat Anh Vu for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.65.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. Vulnerable versions This vulnerability is present in Ghost from v4.22.0 up to v6.64.0. Patches v6.65.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Ibrahim AlJaafreh of Cystack Red Team, Anand Prajapati, 白墨, and Nhat Anh Vu for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.65.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable versions This vulnerability is present in Ghost from v2.1.0 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks SecBuddyF of Tencent KeenLab and Nhat Anh Vu for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.64.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. Vulnerable versions This vulnerability is present in Ghost from v5.94.0 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Thai Son Dinh of VinSOC Labs and 白墨 for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.64.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks carfeii and Nhat Anh Vu for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.64.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This vulnerability is present in Ghost from v4.39.0 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks CoryRoo, Pedro Pinho, and Nhat Anh Vu for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.64.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Miguel Segovia Gil of KPMG and Nguyễn Quốc Đồng for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.64.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Miguel Segovia Gil of KPMG, Alemmi, and Tomer-PL for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.64.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. Vulnerable versions This vulnerability is present in Ghost from v0.5.0 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks SecBuddyF of Tencent KeenLab, Santosh Kumar Puppala, Pedro Pinho, and Nhat Anh Vu for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.64.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file extension. This could be used to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. Vulnerable versions This vulnerability is present in Ghost from v6.22.1 up to v6.64.0. Patches v6.64.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks evertrustai, Thai Son Dinh of VinSOC Labs, Enis Atılgan, Doan Manh Duc, Harshit Gupta (Mr HAX), 白墨, and Mukul of Parameter for disclosing this vulnerability…
Recommended action: Upgrade to 6.64.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Staff with the Author role could delete posts and pages that they did not author. Vulnerable versions This vulnerability is present in Ghost from v5.81.0 up to v6.60.0. Patches v6.60.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Ethan Wilkins of Armadin, Mihir Shishulkar, Jan Kahmen of TuringPoint, and Hao Long for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.60.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An input validation issue allowed members to access comments they were not authorized to access. Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. Patches v6.44.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Himanshu Anand (@anandhimanshu) for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.44.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. Vulnerable versions This vulnerability is present in Ghost from v1.18.0 up to v6.27.0. Patches v6.27.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks 0xkakash1, rooks00, l3tchupkt, Wernerina, krn0@bugcrowdninja.com, and Mohamed Bassia for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. Vulnerable versions This vulnerability is present in Ghost from v6.14.0 up to v6.27.0. Patches v6.27.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks l3tchupkt and krn0@bugcrowdninja.com for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. Vulnerable versions This vulnerability is present in Ghost from v5.46.1 up to v6.21.1. Patches v6.21.2 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. Workarounds If upgrading immediately is not possible, block or filter requests to Content API endpoints where the filter query parameter contains password or email…
Recommended action: Upgrade to 6.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation. Vulnerable versions This vulnerability is present in Ghost from v4.9.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Versa for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. Vulnerable versions This vulnerability is present in Ghost from v6.26.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Hwang Seyeon for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in Ghost's public donation checkout flow allowed an unauthenticated attacker to obtain full paid gift memberships for a minimal payment. No customer or member data was exposed, and the issue could not be used to steal money from a site or its members. Vulnerable versions This vulnerability is present in Ghost from v6.27.0 up to v6.43.1. Patches v6.44.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker’s official Ghost image on Docker Hub and follow the documentation on updating a Docker-based Ghost instance. For self-hosters using Ghost-CLI, see the documentation for updating Ghost to the latest version. Workarounds If upgrading immediately is not possible, you can remove the vulnerable checkout path by disabling the donations feature in Ghost Admin under Settings → Membership → Tips & donations until the upgrade is applied. References Ghost thanks sane100400 and p4p3r for disclosing this vulnerability responsibly. For more…
Recommended action: Upgrade to 6.44.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.