- Latest release
- 6.75.0 (Nov 4, 2026): no advisory affects it
- Newest unaffected release
- 6.75.0 (Nov 4, 2026), the latest release
- Advisories
- 70 · 3 critical, 22 high, 37 medium, 4 low
- Weekly downloads
- 27.6K
- Dependents
- 0
- Releases
- 500+ since 4.47.0 (May 4, 2022)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-105683Affects 6.14.0 to 6.26.0 (6.27.0 is outside it)
- CVE-2026-105682Affects 4.47.0 to 6.26.0 (6.27.0 is outside it)
- CVE-2026-105681Affects 5.9.0 to 6.44.0 (6.44.1 is outside it)
- CVE-2026-105680Affects 5.81.0 to 6.59.0 (6.60.0 is outside it)
- CVE-2026-105679Affects 6.22.1 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105678Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105677Affects 6.10.3 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105676Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105675Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105652Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105651Affects 5.94.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105650Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
Show all 70 advisoriesShow fewer advisories
- CVE-2026-105649Affects 4.47.0 to 6.64.0 (6.65.0 is outside it)
- CVE-2026-105648Affects 6.0.9 to 6.64.0 (6.65.0 is outside it)
- CVE-2026-105647Affects 6.54.1 to 6.64.0 (6.65.0 is outside it)
- CVE-2026-105646Affects 4.47.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-105645Affects 5.37.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-105644Affects 4.47.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-105643Affects 6.34.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-105642Affects 6.56.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-104418Affects 6.10.3 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104417Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104416Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104415Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104414Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104413Affects 5.94.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104412Affects 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104411Affects 6.22.1 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-103290Affects 6.14.0 to 6.26.0 (6.27.0 is outside it)
- CVE-2026-103289Affects 5.9.0 to 6.44.0 (6.44.1 is outside it)
- CVE-2026-103288Affects 5.9.0 to 6.44.0 (6.44.1 is outside it)
- CVE-2026-103287Affects 4.47.0 to 6.26.0 (6.27.0 is outside it)
- CVE-2026-70596Affects 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70595Affects 6.26.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70594Affects 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70593Affects 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70592Affects 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70591Affects 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70590Affects 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70589Affects 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70588Affects 5.26.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-59817Affects 6.27.0 to 6.43.1 (6.44.0 is outside it)
- CVE-2026-53943Affects 4.47.0 to 6.36.0 (6.37.0 is outside it)
- CVE-2026-53944Affects 6.0.9 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53945Affects 6.0.9 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53946Affects 6.19.4 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53947Affects 5.18.0 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53948Affects 6.19.4 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53949Affects 5.46.1 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-29784Affects 5.101.6 to 6.19.2 (6.19.3 is outside it)
- CVE-2026-29053Affects 4.47.0 to 6.19.0 (6.19.1 is outside it)
- CVE-2026-26980Affects 4.47.0 to 6.19.0 (6.19.1 is outside it)
- CVE-2026-24778Affects 5.43.0 to 5.120.4 (5.121.0 is outside it); 6.0.0 to 6.14.0 (6.15.0 is outside it)
- CVE-2026-22597Affects 5.105.0 to 5.130.5 (5.130.6 is outside it); 6.0.0 to 6.10.3 (6.11.0 is outside it)
- CVE-2026-22596Affects 5.105.0 to 5.130.5 (5.130.6 is outside it); 6.0.0 to 6.10.3 (6.11.0 is outside it)
- CVE-2026-22595Affects 5.105.0 to 5.130.5 (5.130.6 is outside it); 6.0.0 to 6.10.3 (6.11.0 is outside it)
- CVE-2026-22594Affects 5.105.0 to 5.130.5 (5.130.6 is outside it); 6.0.0 to 6.10.3 (6.11.0 is outside it)
- CVE-2025-9862Affects 5.99.0 to 5.130.3 (5.130.4 is outside it); 6.0.0 to 6.0.8 (6.0.9 is outside it)
- CVE-2024-43409Affects 4.47.0 to 5.89.4 (5.89.5 is outside it)
- CVE-2024-23724Affects 4.47.0 to 5.76.0 (5.76.1 is outside it)
- CVE-2024-23725Affects 4.47.0 to 5.75.3 (5.76.0 is outside it)
- CVE-2023-40028Affects 4.47.0 to 5.59.0 (5.59.1 is outside it)
- CVE-2023-31133Affects 4.47.0 to 5.46.0 (5.46.1 is outside it)
- CVE-2023-32235Affects 4.47.0 to 5.42.0 (5.42.1 is outside it)
- CVE-2022-41654Affects 4.47.0 to 4.48.7 (4.48.8 is outside it); 5.0.0 to 5.22.6 (5.22.7 is outside it)
- CVE-2022-28397No published release is affectedNo published release is affected
- CVE-2022-27139No published release is affectedNo published release is affected
- CVE-2021-39192No published release is affectedNo published release is affected
- CVE-2021-29484No published release is affectedNo published release is affected
- CVE-2020-8134No published release is affectedNo published release is affected
Advisories 70
- CVE-2026-105683Low 3.8
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Affected: from 6.14.0, fixed in 6.27.0.
Fixed in 6.27.0 (released Apr 8, 2026, 180 days before disclosure).
The latest release, 6.75.0, is not affected.
3.1% of ghost downloads last week were affected versions (878).
- CVE-2026-105682Low 2.7
Ghost: Server-Side Request Forgery in Webhook Trigger
Affected: from 1.18.0, fixed in 6.27.0.
Fixed in 6.27.0 (released Apr 8, 2026, 180 days before disclosure).
The latest release, 6.75.0, is not affected.
71% of ghost downloads last week were affected versions (20.3K).
- CVE-2026-105681Medium 6.5
Ghost: Authorization Bypass in Comments Feature
Affected: from 5.9.0, fixed in 6.44.1.
Fixed in 6.44.1 (released Jun 5, 2026, 122 days before disclosure).
The latest release, 6.75.0, is not affected.
48% of ghost downloads last week were affected versions (13.7K).
- CVE-2026-105680Medium 6.5
Ghost: Authorization Issue Allowed Author Role to Delete any Post
Affected: from 5.81.0, fixed in 6.60.0.
Fixed in 6.60.0 (released Aug 25, 2026, 41 days before disclosure).
The latest release, 6.75.0, is not affected.
37% of ghost downloads last week were affected versions (10.6K).
- CVE-2026-105679High 7.3
Ghost: Stored XSS via File Uploads on Local Storage
Affected: from 6.22.1, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
The latest release, 6.75.0, is not affected.
7.5% of ghost downloads last week were affected versions (2.1K).
- CVE-2026-105678Medium 4.3
Ghost: Editors Could Promote Staff Users to Their Own Role
Affected: from 0.5.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
The latest release, 6.75.0, is not affected.
83% of ghost downloads last week were affected versions (23.6K).
- CVE-2026-105677High 7.2
Ghost: Remote Code Execution via Theme Translation Files
Affected: from 6.10.3, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
The latest release, 6.75.0, is not affected.
11% of ghost downloads last week were affected versions (3K).
- CVE-2026-105676Medium 4.9
Ghost: Path Traversal via Locale Setting
Affected: from 1.20.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
The latest release, 6.75.0, is not affected.
78% of ghost downloads last week were affected versions (22.1K).
- CVE-2026-105675High 7.5
Ghost: Invite Token Disclosure in Ghost Admin API
Affected: from 4.39.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
The latest release, 6.75.0, is not affected.
56% of ghost downloads last week were affected versions (15.9K).
- CVE-2026-105652Low 3.1
Ghost: Password Hash Ordering Disclosure in Ghost Admin API
Affected: from 0.7.2, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
The latest release, 6.75.0, is not affected.
82% of ghost downloads last week were affected versions (23.4K).
- CVE-2026-105651High 7.3
Ghost: Stored XSS via Bookmark Card Images
Affected: from 5.94.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
The latest release, 6.75.0, is not affected.
35% of ghost downloads last week were affected versions (10K).
- CVE-2026-105650High 8.1
Ghost: Stored XSS via oEmbed Photo Responses
Affected: from 2.5.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
The latest release, 6.75.0, is not affected.
72% of ghost downloads last week were affected versions (20.6K).
- CVE-2026-105649High 7.3
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
Affected: from 4.22.0, fixed in 6.65.0.
Fixed in 6.65.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 6.75.0, is not affected.
58% of ghost downloads last week were affected versions (16.5K).
- CVE-2026-105648Medium 4.0
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Affected: from 6.0.9, fixed in 6.65.0.
Fixed in 6.65.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 6.75.0, is not affected.
19% of ghost downloads last week were affected versions (5.5K).
- CVE-2026-105647Medium 4.0
Ghost: Server-Side Request Forgery in Bookmark Fetching
Affected: from 6.54.1, fixed in 6.65.0.
Fixed in 6.65.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 6.75.0, is not affected.
2.4% of ghost downloads last week were affected versions (692).
Show all 70 advisoriesShow fewer advisories
- CVE-2026-105646Medium 4.9
Ghost: Regular Expression Denial of Service in Content Import
Affected: from 4.0.0, fixed in 6.67.0.
Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
The latest release, 6.75.0, is not affected.
63% of ghost downloads last week were affected versions (17.8K).
- CVE-2026-105645Medium 4.9
Ghost: Regular Expression Denial of Service in External Media Inliner
Affected: from 5.37.0, fixed in 6.67.0.
Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
The latest release, 6.75.0, is not affected.
48% of ghost downloads last week were affected versions (13.6K).
- CVE-2026-105644Medium 6.8
Ghost: Stored XSS via SVG Files in Content Imports
Affected: from 4.0.0, fixed in 6.67.0.
Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
The latest release, 6.75.0, is not affected.
63% of ghost downloads last week were affected versions (17.8K).
- CVE-2026-105643High 7.3
Ghost: Stored XSS via Embed Card Previews
Affected: from 6.34.0, fixed in 6.67.0.
Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
The latest release, 6.75.0, is not affected.
7.1% of ghost downloads last week were affected versions (2K).
- CVE-2026-105642High 8.8
Ghost: Remote Code Execution via Bookmark Card Images
Affected: from 6.56.0, fixed in 6.67.0.
Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
The latest release, 6.75.0, is not affected.
2.6% of ghost downloads last week were affected versions (733).
- CVE-2026-104418High 8.6
Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files
Affected: from 6.10.3, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
11% of ghost downloads last week were affected versions (3K).
- CVE-2026-104417Medium 6.9
Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
Affected: from 1.20.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
78% of ghost downloads last week were affected versions (22.1K).
- CVE-2026-104416High 7.7
Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
Affected: from 4.39.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
56% of ghost downloads last week were affected versions (15.9K).
- CVE-2026-104415Low 2.3
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
Affected: from 0.7.2, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
82% of ghost downloads last week were affected versions (23.4K).
- CVE-2026-104414High 8.6
Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
Affected: from 2.5.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
72% of ghost downloads last week were affected versions (20.6K).
- CVE-2026-104413High 8.5
Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
Affected: from 5.94.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
35% of ghost downloads last week were affected versions (10K).
- CVE-2026-104412Medium 5.3
Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
Affected: from 0.5.0, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
83% of ghost downloads last week were affected versions (23.6K).
- CVE-2026-104411High 8.5
Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
Affected: from 6.22.1, fixed in 6.64.0.
Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
7.5% of ghost downloads last week were affected versions (2.1K).
- CVE-2026-103290Medium 5.1
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
Affected: from 6.14.0, fixed in 6.27.0.
Fixed in 6.27.0 (released Apr 8, 2026, 176 days before disclosure).
The latest release, 6.75.0, is not affected.
3.1% of ghost downloads last week were affected versions (878).
- CVE-2026-103289High 7.1
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
Affected: from 5.9.0, fixed in 6.44.1.
Fixed in 6.44.1 (released Jun 5, 2026, 118 days before disclosure).
The latest release, 6.75.0, is not affected.
48% of ghost downloads last week were affected versions (13.7K).
- CVE-2026-103288High 7.1
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
Affected: from 5.9.0, fixed in 6.44.1.
Fixed in 6.44.1 (released Jun 5, 2026, 118 days before disclosure).
The latest release, 6.75.0, is not affected.
48% of ghost downloads last week were affected versions (13.7K).
- CVE-2026-103287Medium 5.1
Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
Affected: from 1.18.0, fixed in 6.27.0.
Fixed in 6.27.0 (released Apr 8, 2026, 176 days before disclosure).
The latest release, 6.75.0, is not affected.
71% of ghost downloads last week were affected versions (20.3K).
- CVE-2026-70596Medium 4.3
Ghost: Cross-Site Scripting in Feature Image Captions
Affected: from 4.9.0, fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 9 days before disclosure).
The latest release, 6.75.0, is not affected.
57% of ghost downloads last week were affected versions (16.3K).
- CVE-2026-70595Medium 4.0
Ghost: Server-Side Request Forgery Mitigation Issue
Affected: from 6.26.0, fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 9 days before disclosure).
The latest release, 6.75.0, is not affected.
4.9% of ghost downloads last week were affected versions (1.4K).
- CVE-2026-70594Medium 6.7
Ghost: Session Fixation in Ghost Admin
Affected: from 2.2.0, fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 6.75.0, is not affected.
71% of ghost downloads last week were affected versions (20.1K).
- CVE-2026-70593Medium 6.6
Ghost: Theme Upload Path Traversal
Affected: from 0.10.0, fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 6.75.0, is not affected.
79% of ghost downloads last week were affected versions (22.6K).
- CVE-2026-70592Medium 5.5
Ghost: Database Backup Path Traversal
Affected: from 1.20.1, fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 6.75.0, is not affected.
76% of ghost downloads last week were affected versions (21.5K).
- CVE-2026-70591Medium 4.1
Ghost: Server-Side Request Forgery in Image Fetching
Affected: from 0.10.0, fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 6.75.0, is not affected.
79% of ghost downloads last week were affected versions (22.6K).
- CVE-2026-70590Medium 4.8
Ghost: Blind Password Hash Disclosure in Ghost Admin API
Affected: fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 6.75.0, is not affected.
81% of ghost downloads last week were affected versions (23K).
- CVE-2026-70589Medium 4.8
Ghost: Archived Offers can be Redeemed
Affected: from 4.22.0, fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 6.75.0, is not affected.
56% of ghost downloads last week were affected versions (15.8K).
- CVE-2026-70588Medium 5.0
Ghost: Cross-Site Scripting in Universal Import
Affected: from 5.26.0, fixed in 6.54.1.
Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 6.75.0, is not affected.
47% of ghost downloads last week were affected versions (13.2K).
- CVE-2026-59817Medium 5.3
Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
Affected: from 6.27.0, fixed in 6.44.0.
Fixed in 6.44.0 (released Jun 3, 2026, 36 days before disclosure).
The latest release, 6.75.0, is not affected.
2.6% of ghost downloads last week were affected versions (744).
- CVE-2026-53943Critical 9.6
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
Affected: from 4.0.0, fixed in 6.37.0.
Fixed in 6.37.0 (released May 7, 2026, 48 days before disclosure).
The latest release, 6.75.0, is not affected.
56% of ghost downloads last week were affected versions (15.9K).
- CVE-2026-53944Medium 5.8
Ghost: Private IP filtering bypass to make server-side requests to internal services
Affected: from 6.0.9, fixed in 6.21.1.
Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure, the advisory names 6.21.1, which was never published).
The latest release, 6.75.0, is not affected.
11% of ghost downloads last week were affected versions (3.3K).
- CVE-2026-53945Medium 4.0
Ghost: Server-side request forgery via DNS rebinding in external request handling
Affected: from 6.0.9, fixed in 6.21.2.
Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure).
The latest release, 6.75.0, is not affected.
11% of ghost downloads last week were affected versions (3.3K).
- CVE-2026-53946Medium 5.4
Ghost: Mobiledoc image-size fetch SSRF
Affected: from 6.19.4, fixed in 6.21.2.
Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure).
The latest release, 6.75.0, is not affected.
0.5% of ghost downloads last week were affected versions (136).
- CVE-2026-53947Medium 5.3
Ghost: Member existence leak via magic link sign-in response
Affected: from 5.18.0, fixed in 6.21.2.
Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure).
The latest release, 6.75.0, is not affected.
43% of ghost downloads last week were affected versions (12.2K).
- CVE-2026-53948Medium 5.4
Ghost: File Upload Content-Type Spoofing
Affected: from 6.19.4, fixed in 6.21.1.
Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure, the advisory names 6.21.1, which was never published).
The latest release, 6.75.0, is not affected.
0.5% of ghost downloads last week were affected versions (136).
- CVE-2026-53949Medium 5.3
Ghost Content API filter bypass reveals private fields
Affected: from 5.46.1, fixed in 6.21.2.
Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure).
The latest release, 6.75.0, is not affected.
38% of ghost downloads last week were affected versions (10.8K).
- CVE-2026-29784High 7.5
Ghost: Incomplete CSRF protections around OTC use
Affected: from 5.101.6, fixed in 6.19.3.
Fixed in 6.19.3 (released Feb 26, 2026, 9 days before disclosure).
The latest release, 6.75.0, is not affected.
25% of ghost downloads last week were affected versions (7.1K).
- CVE-2026-29053High 7.7
Ghost Vulnerable to Remote Code Execution via Malicious Themes
Affected: from 0.7.2, fixed in 6.19.1.
Fixed in 6.19.1 (released Feb 16, 2026, 17 days before disclosure).
The latest release, 6.75.0, is not affected.
73% of ghost downloads last week were affected versions (20.9K).
- CVE-2026-26980Critical 9.4
Ghost has a SQL Injection in its Content API
Affected: from 3.24.0, fixed in 6.19.1.
Fixed in 6.19.1 (released Feb 16, 2026, 4 days before disclosure).
The latest release, 6.75.0, is not affected.
57% of ghost downloads last week were affected versions (16.1K).
- CVE-2026-24778High 8.8
Ghost vulnerable to XSS via malicious Portal preview links
Affected: from 5.43.0, fixed in 5.121.0; from 6.0.0, fixed in 6.15.0.
Fixed in 5.121.0 (released May 30, 2025, 242 days before disclosure) and 6.15.0 (released Jan 27, 2026, the day of disclosure).
The latest release, 6.75.0, is not affected.
30% of ghost downloads last week were affected versions (8.4K).
- CVE-2026-22597Medium 5.1
Ghost has SSRF via External Media Inliner
Affected: from 6.0.0, fixed in 6.11.0; from 5.105.0, fixed in 5.130.6.
Fixed in 5.130.6 (released Jan 8, 2026, 2 days before disclosure) and 6.11.0 (released Jan 8, 2026, 2 days before disclosure).
The latest release, 6.75.0, is not affected.
19% of ghost downloads last week were affected versions (5.4K).
- CVE-2026-22596Medium 6.7
Ghost has SQL Injection in Members Activity Feed
Affected: from 6.0.0, fixed in 6.11.0; from 5.105.0, fixed in 5.130.6.
Fixed in 5.130.6 (released Jan 8, 2026, 2 days before disclosure) and 6.11.0 (released Jan 8, 2026, 2 days before disclosure).
The latest release, 6.75.0, is not affected.
19% of ghost downloads last week were affected versions (5.4K).
- CVE-2026-22595High 8.1
Ghost has Staff Token permission bypass
Affected: from 6.0.0, fixed in 6.11.0; from 5.105.0, fixed in 5.130.6.
Fixed in 5.130.6 (released Jan 8, 2026, 2 days before disclosure) and 6.11.0 (released Jan 8, 2026, 2 days before disclosure).
The latest release, 6.75.0, is not affected.
19% of ghost downloads last week were affected versions (5.4K).
- CVE-2026-22594High 8.1
Ghost has Staff 2FA bypass
Affected: from 6.0.0, fixed in 6.11.0; from 5.105.0, fixed in 5.130.6.
Fixed in 5.130.6 (released Jan 8, 2026, 2 days before disclosure) and 6.11.0 (released Jan 8, 2026, 2 days before disclosure).
The latest release, 6.75.0, is not affected.
19% of ghost downloads last week were affected versions (5.4K).
- CVE-2025-9862Medium 6.1
Ghost 6.0.6 - SSRF via oEmbed Bookmark
Affected: from 6.0.0, fixed in 6.0.9; from 5.99.0, fixed in 5.130.4.
Fixed in 5.130.4 (released Aug 12, 2025, 36 days before disclosure) and 6.0.9 (released Sep 14, 2025, 3 days before disclosure).
The latest release, 6.75.0, is not affected.
11% of ghost downloads last week were affected versions (3.1K).
- CVE-2024-43409Medium 6.5
Ghost's improper authentication allows access to member information and actions
Affected: from 4.46.0, fixed in 5.89.5.
Fixed in 5.89.5 (released Aug 20, 2024, the day of disclosure).
The latest release, 6.75.0, is not affected.
19% of ghost downloads last week were affected versions (5.5K).
- CVE-2024-23724Unrated
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG…
Affected: through 5.76.0.
Fixed in 5.76.1 (released Jan 22, 2024, 20 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 6.75.0, is not affected.
44% of ghost downloads last week were affected versions (12.4K).
- CVE-2024-23725Medium 6.1
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js.
Affected: fixed in 5.76.0.
Fixed in 5.76.0 (released Jan 17, 2024, 4 days before disclosure).
The latest release, 6.75.0, is not affected.
43% of ghost downloads last week were affected versions (12.4K).
- CVE-2023-40028Medium 4.9
Arbitrary file read via symlinks in Ghost
Affected: fixed in 5.59.1.
Fixed in 5.59.1 (released Aug 15, 2023, the day of disclosure).
The latest release, 6.75.0, is not affected.
40% of ghost downloads last week were affected versions (11.5K).
- CVE-2023-31133High 7.5
Ghost vulnerable to disclosure of private API fields
Affected: fixed in 5.46.1.
Fixed in 5.46.1 (released May 3, 2023, 5 days before disclosure).
The latest release, 6.75.0, is not affected.
37% of ghost downloads last week were affected versions (10.6K).
- CVE-2023-32235High 7.5
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/…
Affected: fixed in 5.42.1.
Fixed in 5.42.1 (released Apr 7, 2023, 28 days before disclosure).
The latest release, 6.75.0, is not affected.
37% of ghost downloads last week were affected versions (10.5K).
- CVE-2022-41654Critical 9.6
An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.
Affected: from 5.0.0, fixed in 5.22.7; from 4.46.0, fixed in 4.48.8.
Fixed in 4.48.8 (released Nov 15, 2022, 38 days before disclosure) and 5.22.7 (released Nov 7, 2022, 46 days before disclosure).
The latest release, 6.75.0, is not affected.
5% of ghost downloads last week were affected versions (1.4K).
- CVE-2022-28397Unrated
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a…
Affected: through 4.42.0.
Fixed in 4.47.0 (released May 4, 2022, 22 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 6.75.0, is not affected.
28% of ghost downloads last week were affected versions (7.9K).
- CVE-2022-27139Unrated
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted…
Affected: through 4.39.0.
Fixed in 4.47.0 (released May 4, 2022, 22 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 6.75.0, is not affected.
27% of ghost downloads last week were affected versions (7.8K).
- CVE-2021-39192Medium 6.5
Privilege escalation: all users can access Admin-level API keys
Affected: from 4.0.0, fixed in 4.10.0.
Fixed in 4.10.0.
The latest release, 6.75.0, is not affected.
3% of ghost downloads last week were affected versions (854).
- CVE-2021-29484Medium 6.8
DOM XSS in Theme Preview
Affected: from 4.0.0, fixed in 4.3.3.
Fixed in 4.3.3.
The latest release, 6.75.0, is not affected.
1.3% of ghost downloads last week were affected versions (375).
- CVE-2020-8134Unrated
Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise…
Affected: fixed in 3.10.0.
Fixed in 3.10.0.
The latest release, 6.75.0, is not affected.
16% of ghost downloads last week were affected versions (4.6K).