CVE-2026-22597
Low · 2.7CVSS
2.7
EPSS
0.3%
Published
Jan 10, 2026
CISA due date
—
The record
Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | ghost | 5.105.0 | 5.130.6 |
| npm | ghost | 6.0.0 | 6.11.0 |
| Bitnami | ghost | 5.38.0 | 5.130.6 |
Related vulnerabilities
- GHSA-vmc4-9828-r48r Ghost has SSRF via External Media Inliner Same vulnerability
- CVE-2026-29784 Ghost is a Node.js content management system. Also affects ghost
- CVE-2026-29053 Ghost is a Node.js content management system. Also affects ghost
- GHSA-9m84-wc28-w895 Ghost has incomplete CSRF protections around OTC use Also affects ghost
- GHSA-cgc2-rcrh-qr5x Ghost Vulnerable to Remote Code Execution via Malicious Themes Also affects ghost
- CVE-2026-26980 Ghost is a Node.js content management system. Also affects ghost
- GHSA-w52v-v783-gw97 Ghost has a SQL injection in Content API Also affects ghost
- GHSA-gv6q-2m97-882h Ghost vulnerable to XSS via malicious Portal preview links Also affects ghost