---
id: CVE-2026-70591
title: Ghost is a Node.js content management system
summary: >-
  Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a
  Server-Side Request Forgery in Ghost Admin image fetching allowed any
  staff-level user to perform a blind HTTP GET request against internal hosts.
  No output was re…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: ghost
product: ghost
affected:
  - 'ghost >= 0.10.0, < 6.54.1'
patched:
  - ghost 6.54.1
published: '2026-08-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70591'
references:
  - url: >-
      https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/releases/tag/v6.54.1'
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-gcvv-72q8-9v76'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00226
epssPercentile: 0.13552
aliases:
  - GHSA-gcvv-72q8-9v76
ecosystem: npm
ingestedAt: '2026-08-04T21:42:19.336Z'
---

## Overview

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-70591)

Affected packages:

- `ghost >= 0.10.0, < 6.54.1`

Patched in:

- `ghost 6.54.1`

Source: https://github.com/advisories/GHSA-gcvv-72q8-9v76