Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
56 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost from v2.2.0 to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks meifukun for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation. Vulnerable versions This vulnerability is present in Ghost from v0.10.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Stephen Sims, Off By One Security for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions This vulnerability is present in Ghost from 1.20.1 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. Workarounds If upgrading immediately is not possible, set disableJSBackups to "true" by running: References Ghost thanks Jorian Woltjer of Aikido Security, Mitchell Benjamin of Revamp Studio, and meifukun for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A Server-Side Request Forgery (SSRF) in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost from v0.10.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Younghun Ko, vx77, and Miguel Segovia Gil for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. Vulnerable versions This vulnerability is present in Ghost versions v6.54.0 and earlier. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. Workarounds If upgrading immediately is not possible, ensure all staff users have Multi-factor Authentication (MFA) enabled. This will help prevent an attacker from…
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. Vulnerable versions This vulnerability is present in Ghost from v6.0.9 up to v6.21.0. Patches v6.21.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks l3tchupkt for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.21.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A missing validation check allowed users to redeem subscription offers that were no longer active. Vulnerable versions This vulnerability is present in Ghost from v4.22.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. References Ghost thanks Pedro Pinho for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff. Vulnerable versions This vulnerability is present in Ghost from v6.19.4 up to v6.21.0. Patches v6.21.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.21.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. Vulnerable versions This vulnerability is present in Ghost from v5.26.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here. Workarounds If upgrading immediately is not possible, avoid using the Universal Import feature. References Ghost thanks meifukun for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.54.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When Ghost is behind a shared caching layer that results in cached content being shared between different visitors (e.g., Fastly, Cloudflare, nginx proxycache, and others), an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the same page, allowing cache poisoning of request-specific preview output. When running Ghost's frontend and admin panel on the same domain this could be used to take over staff user accounts. When running these on different domains staff accounts have no exposure. Vulnerable versions This vulnerability is present in Ghost from v4.0 up to v6.36.0. Patches v6.37.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If your Ghost is a Ghost-CLI install see our documentation…
Recommended action: Upgrade to 6.37.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. Vulnerable versions This vulnerability is present in Ghost from v5.101.6 up to v6.19.2. Patches v6.19.3 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here. For more information If there are any questions or comments about this advisory, send an email to security@ghost.org.
Recommended action: Upgrade to 6.19.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Specifically crafted malicious themes can execute arbitrary code on the server running Ghost. Vulnerable Versions This vulnerability is present in Ghost v0.7.2 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Workarounds Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific. References Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly. For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. Vulnerable Versions This vulnerability is present in Ghost v3.24.0 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Note: as this vulnerability lets an attacker gain access to a site's API keys, we recommend reviewing staff users and rotating keys. We generally recommend always updating Ghost to its most current version. Workarounds There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability. As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing slug%3A%5B or slug: in the query string filter parameter. Note that this may break legitimate slug filter functionality. References We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly. For more information…
Recommended action: Upgrade to 6.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Vulnerable versions This vulnerability is present in Ghost versions: - v5.43.0 to v5.120.4 - v6.0.0 to v6.14.0 As well as in Portal versions: - v2.29.1 to v2.51.4 - v2.52.0 to v2.57.0 Patches Ghost automatically loads the latest patch of the members Portal component via CDN. Therefore: - For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability (loads Portal v2.51.5, which contains the patch) - For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability (loads Portal v2.57.1, which contains the patch) For Ghost installations using a customised or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version. References Ghost thanks Younes Belalia for discovering and disclosing this…
Recommended action: Upgrade to 6.15.0 or 5.121.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. Vulnerable versions This vulnerability is present in Ghost v5.90.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3. Patches v5.130.6 and v6.11.0 contain a fix for this issue. References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly. For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.11.0 or 5.130.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. Vulnerable versions This vulnerability is present in Ghost v5.38.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3. Patches v5.130.6 and v6.11.0 contain a fix for this issue. References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly. For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.11.0 or 5.130.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. Vulnerable versions This vulnerability is present in Ghost v5.121.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3. Patches v5.130.6 and v6.11.0 contain a fix for this issue. References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly. For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.11.0 or 5.130.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. Vulnerable versions This vulnerability is present in Ghost v5.105.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3. Patches v5.130.6 and v6.11.0 contain a fix for this issue. References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly. For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Recommended action: Upgrade to 6.11.0 or 5.130.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF. Vulnerable versions This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8. Patches v5.130.4 and v6.0.9 contain a fix for this issue. References The original report is available here: https://fluidattacks.com/advisories/regida We thank Cristian Vargas for discovering and disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Recommended action: Upgrade to 6.0.9 or 5.130.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. Vulnerable versions This security vulnerability is present in Ghost v4.46.0-v5.89.5. Ghost(Pro) customers are automatically updated to fixed versions ahead of disclosure. If you're a self-hoster, please follow our update instructions. Patches v5.89.5 contains a fix for this issue. Workarounds Disable site membership in Ghost settings. For more information If you have any questions or comments about this advisory: Email us at security@ghost.org
Recommended action: Upgrade to 5.89.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.
Recommended action: Upgrade to 5.76.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in Ghost allows authenticated users to upload files which are symlinks. This can be exploited to perform an arbitrary file read of any file on the operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder Vulnerable versions This security vulnerability is present in Ghost ≤ v5.59.0. Patches v5.59.1 contains a fix for this issue. For more information If you have any questions or comments about this advisory: Email us at security@ghost.org
Recommended action: Upgrade to 5.59.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
Recommended action: Upgrade to 5.42.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below. Patches v5.46.1 contains a fix for this issue. Workarounds Add a block for requests to /ghost/api/content/ where the filter query parameter contains password or email. For more information If you have any questions or comments about this advisory: Email us at security@ghost.org
Recommended action: Upgrade to 5.46.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact On sites where members is enabled (this is the default) it is possible for members (unprivileged users) to make changes to newsletter settings. This gives unprivileged users the ability to view and change settings they were not intended to have access to. They are not able to escalate their privileges permanently or get access to further information. This issue was caused by a gap in our API validation for nested objects. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version between v4.46.0 and v4.48.7 or any version of v5 prior to v5.22.7. Immediate action should be taken to secure your site - see patches & workarounds below. Patches - v4.48.8 / v5.22.7 are patched for all known exploits. - v4.48.9 / v5.24.1 contain deeper fixes to the API to close the potential for this vulnerability to appear elsewhere or regress Workarounds The known…
Recommended action: Upgrade to 5.22.7 or 4.48.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.