# ghost (npm) vulnerabilities

70 known vulnerabilities (3 critical, 22 high, 37 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 6.75.0 (Nov 4, 2026): no advisory affects it
- Newest unaffected release: 6.75.0 (Nov 4, 2026), the latest release
- Weekly downloads: 27.6K
- Dependents: 0
- Releases: 500+ since 4.47.0 (May 4, 2022)
- Registry: https://www.npmjs.com/package/ghost
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-105683: 6.14.0 to 6.26.0 (6.27.0 is outside it)
- CVE-2026-105682: 4.47.0 to 6.26.0 (6.27.0 is outside it)
- CVE-2026-105681: 5.9.0 to 6.44.0 (6.44.1 is outside it)
- CVE-2026-105680: 5.81.0 to 6.59.0 (6.60.0 is outside it)
- CVE-2026-105679: 6.22.1 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105678: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105677: 6.10.3 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105676: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105675: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105652: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105651: 5.94.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105650: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-105649: 4.47.0 to 6.64.0 (6.65.0 is outside it)
- CVE-2026-105648: 6.0.9 to 6.64.0 (6.65.0 is outside it)
- CVE-2026-105647: 6.54.1 to 6.64.0 (6.65.0 is outside it)
- CVE-2026-105646: 4.47.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-105645: 5.37.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-105644: 4.47.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-105643: 6.34.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-105642: 6.56.0 to 6.65.0 (6.67.0 is outside it)
- CVE-2026-104418: 6.10.3 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104417: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104416: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104415: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104414: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104413: 5.94.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104412: 4.47.0 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-104411: 6.22.1 to 6.63.0 (6.64.0 is outside it)
- CVE-2026-103290: 6.14.0 to 6.26.0 (6.27.0 is outside it)
- CVE-2026-103289: 5.9.0 to 6.44.0 (6.44.1 is outside it)
- CVE-2026-103288: 5.9.0 to 6.44.0 (6.44.1 is outside it)
- CVE-2026-103287: 4.47.0 to 6.26.0 (6.27.0 is outside it)
- CVE-2026-70596: 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70595: 6.26.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70594: 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70593: 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70592: 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70591: 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70590: 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70589: 4.47.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-70588: 5.26.0 to 6.54.0 (6.54.1 is outside it)
- CVE-2026-59817: 6.27.0 to 6.43.1 (6.44.0 is outside it)
- CVE-2026-53943: 4.47.0 to 6.36.0 (6.37.0 is outside it)
- CVE-2026-53944: 6.0.9 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53945: 6.0.9 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53946: 6.19.4 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53947: 5.18.0 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53948: 6.19.4 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-53949: 5.46.1 to 6.21.0 (6.21.2 is outside it)
- CVE-2026-29784: 5.101.6 to 6.19.2 (6.19.3 is outside it)
- CVE-2026-29053: 4.47.0 to 6.19.0 (6.19.1 is outside it)
- CVE-2026-26980: 4.47.0 to 6.19.0 (6.19.1 is outside it)
- CVE-2026-24778: 5.43.0 to 5.120.4 (5.121.0 is outside it); 6.0.0 to 6.14.0 (6.15.0 is outside it)
- CVE-2026-22597: 5.105.0 to 5.130.5 (5.130.6 is outside it); 6.0.0 to 6.10.3 (6.11.0 is outside it)
- CVE-2026-22596: 5.105.0 to 5.130.5 (5.130.6 is outside it); 6.0.0 to 6.10.3 (6.11.0 is outside it)
- CVE-2026-22595: 5.105.0 to 5.130.5 (5.130.6 is outside it); 6.0.0 to 6.10.3 (6.11.0 is outside it)
- CVE-2026-22594: 5.105.0 to 5.130.5 (5.130.6 is outside it); 6.0.0 to 6.10.3 (6.11.0 is outside it)
- CVE-2025-9862: 5.99.0 to 5.130.3 (5.130.4 is outside it); 6.0.0 to 6.0.8 (6.0.9 is outside it)
- CVE-2024-43409: 4.47.0 to 5.89.4 (5.89.5 is outside it)
- CVE-2024-23724: 4.47.0 to 5.76.0 (5.76.1 is outside it)
- CVE-2024-23725: 4.47.0 to 5.75.3 (5.76.0 is outside it)
- CVE-2023-40028: 4.47.0 to 5.59.0 (5.59.1 is outside it)
- CVE-2023-31133: 4.47.0 to 5.46.0 (5.46.1 is outside it)
- CVE-2023-32235: 4.47.0 to 5.42.0 (5.42.1 is outside it)
- CVE-2022-41654: 4.47.0 to 4.48.7 (4.48.8 is outside it); 5.0.0 to 5.22.6 (5.22.7 is outside it)
- CVE-2022-28397: no published release is affected
- CVE-2022-27139: no published release is affected
- CVE-2021-39192: no published release is affected
- CVE-2021-29484: no published release is affected
- CVE-2020-8134: no published release is affected

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (70)

### [CVE-2026-105683](https://cve.now/CVE-2026-105683): Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

- Severity: Low 3.8
- Published: Oct 5, 2026
- Affected: from 6.14.0, fixed in 6.27.0.
- Fixed in 6.27.0 (released Apr 8, 2026, 180 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 3.1% of ghost downloads last week were affected versions (878).

### [CVE-2026-105682](https://cve.now/CVE-2026-105682): Ghost: Server-Side Request Forgery in Webhook Trigger

- Severity: Low 2.7
- Published: Oct 5, 2026
- Affected: from 1.18.0, fixed in 6.27.0.
- Fixed in 6.27.0 (released Apr 8, 2026, 180 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 71% of ghost downloads last week were affected versions (20.3K).

### [CVE-2026-105681](https://cve.now/CVE-2026-105681): Ghost: Authorization Bypass in Comments Feature

- Severity: Medium 6.5
- Published: Oct 5, 2026
- Affected: from 5.9.0, fixed in 6.44.1.
- Fixed in 6.44.1 (released Jun 5, 2026, 122 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 48% of ghost downloads last week were affected versions (13.7K).

### [CVE-2026-105680](https://cve.now/CVE-2026-105680): Ghost: Authorization Issue Allowed Author Role to Delete any Post

- Severity: Medium 6.5
- Published: Oct 5, 2026
- Affected: from 5.81.0, fixed in 6.60.0.
- Fixed in 6.60.0 (released Aug 25, 2026, 41 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 37% of ghost downloads last week were affected versions (10.6K).

### [CVE-2026-105679](https://cve.now/CVE-2026-105679): Ghost: Stored XSS via File Uploads on Local Storage

- Severity: High 7.3
- Published: Oct 5, 2026
- Affected: from 6.22.1, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 7.5% of ghost downloads last week were affected versions (2.1K).

### [CVE-2026-105678](https://cve.now/CVE-2026-105678): Ghost: Editors Could Promote Staff Users to Their Own Role

- Severity: Medium 4.3
- Published: Oct 5, 2026
- Affected: from 0.5.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 83% of ghost downloads last week were affected versions (23.6K).

### [CVE-2026-105677](https://cve.now/CVE-2026-105677): Ghost: Remote Code Execution via Theme Translation Files

- Severity: High 7.2
- Published: Oct 5, 2026
- Affected: from 6.10.3, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 11% of ghost downloads last week were affected versions (3K).

### [CVE-2026-105676](https://cve.now/CVE-2026-105676): Ghost: Path Traversal via Locale Setting

- Severity: Medium 4.9
- Published: Oct 5, 2026
- Affected: from 1.20.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 78% of ghost downloads last week were affected versions (22.1K).

### [CVE-2026-105675](https://cve.now/CVE-2026-105675): Ghost: Invite Token Disclosure in Ghost Admin API

- Severity: High 7.5
- Published: Oct 5, 2026
- Affected: from 4.39.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 56% of ghost downloads last week were affected versions (15.9K).

### [CVE-2026-105652](https://cve.now/CVE-2026-105652): Ghost: Password Hash Ordering Disclosure in Ghost Admin API

- Severity: Low 3.1
- Published: Oct 5, 2026
- Affected: from 0.7.2, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 82% of ghost downloads last week were affected versions (23.4K).

### [CVE-2026-105651](https://cve.now/CVE-2026-105651): Ghost: Stored XSS via Bookmark Card Images

- Severity: High 7.3
- Published: Oct 5, 2026
- Affected: from 5.94.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 35% of ghost downloads last week were affected versions (10K).

### [CVE-2026-105650](https://cve.now/CVE-2026-105650): Ghost: Stored XSS via oEmbed Photo Responses

- Severity: High 8.1
- Published: Oct 5, 2026
- Affected: from 2.5.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 20 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 72% of ghost downloads last week were affected versions (20.6K).

### [CVE-2026-105649](https://cve.now/CVE-2026-105649): Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

- Severity: High 7.3
- Published: Oct 5, 2026
- Affected: from 4.22.0, fixed in 6.65.0.
- Fixed in 6.65.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 58% of ghost downloads last week were affected versions (16.5K).

### [CVE-2026-105648](https://cve.now/CVE-2026-105648): Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

- Severity: Medium 4.0
- Published: Oct 5, 2026
- Affected: from 6.0.9, fixed in 6.65.0.
- Fixed in 6.65.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 19% of ghost downloads last week were affected versions (5.5K).

### [CVE-2026-105647](https://cve.now/CVE-2026-105647): Ghost: Server-Side Request Forgery in Bookmark Fetching

- Severity: Medium 4.0
- Published: Oct 5, 2026
- Affected: from 6.54.1, fixed in 6.65.0.
- Fixed in 6.65.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 2.4% of ghost downloads last week were affected versions (692).

### [CVE-2026-105646](https://cve.now/CVE-2026-105646): Ghost: Regular Expression Denial of Service in Content Import

- Severity: Medium 4.9
- Published: Oct 5, 2026
- Affected: from 4.0.0, fixed in 6.67.0.
- Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 63% of ghost downloads last week were affected versions (17.8K).

### [CVE-2026-105645](https://cve.now/CVE-2026-105645): Ghost: Regular Expression Denial of Service in External Media Inliner

- Severity: Medium 4.9
- Published: Oct 5, 2026
- Affected: from 5.37.0, fixed in 6.67.0.
- Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 48% of ghost downloads last week were affected versions (13.6K).

### [CVE-2026-105644](https://cve.now/CVE-2026-105644): Ghost: Stored XSS via SVG Files in Content Imports

- Severity: Medium 6.8
- Published: Oct 5, 2026
- Affected: from 4.0.0, fixed in 6.67.0.
- Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 63% of ghost downloads last week were affected versions (17.8K).

### [CVE-2026-105643](https://cve.now/CVE-2026-105643): Ghost: Stored XSS via Embed Card Previews

- Severity: High 7.3
- Published: Oct 5, 2026
- Affected: from 6.34.0, fixed in 6.67.0.
- Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 7.1% of ghost downloads last week were affected versions (2K).

### [CVE-2026-105642](https://cve.now/CVE-2026-105642): Ghost: Remote Code Execution via Bookmark Card Images

- Severity: High 8.8
- Published: Oct 5, 2026
- Affected: from 6.56.0, fixed in 6.67.0.
- Fixed in 6.67.0 (released Sep 29, 2026, 6 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 2.6% of ghost downloads last week were affected versions (733).

### [CVE-2026-104418](https://cve.now/CVE-2026-104418): Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files

- Severity: High 8.6
- Published: Oct 2, 2026
- Affected: from 6.10.3, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 11% of ghost downloads last week were affected versions (3K).

### [CVE-2026-104417](https://cve.now/CVE-2026-104417): Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting

- Severity: Medium 6.9
- Published: Oct 2, 2026
- Affected: from 1.20.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 78% of ghost downloads last week were affected versions (22.1K).

### [CVE-2026-104416](https://cve.now/CVE-2026-104416): Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

- Severity: High 7.7
- Published: Oct 2, 2026
- Affected: from 4.39.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 56% of ghost downloads last week were affected versions (15.9K).

### [CVE-2026-104415](https://cve.now/CVE-2026-104415): Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

- Severity: Low 2.3
- Published: Oct 2, 2026
- Affected: from 0.7.2, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 82% of ghost downloads last week were affected versions (23.4K).

### [CVE-2026-104414](https://cve.now/CVE-2026-104414): Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses

- Severity: High 8.6
- Published: Oct 2, 2026
- Affected: from 2.5.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 72% of ghost downloads last week were affected versions (20.6K).

### [CVE-2026-104413](https://cve.now/CVE-2026-104413): Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

- Severity: High 8.5
- Published: Oct 2, 2026
- Affected: from 5.94.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 35% of ghost downloads last week were affected versions (10K).

### [CVE-2026-104412](https://cve.now/CVE-2026-104412): Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment

- Severity: Medium 5.3
- Published: Oct 2, 2026
- Affected: from 0.5.0, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 83% of ghost downloads last week were affected versions (23.6K).

### [CVE-2026-104411](https://cve.now/CVE-2026-104411): Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

- Severity: High 8.5
- Published: Oct 2, 2026
- Affected: from 6.22.1, fixed in 6.64.0.
- Fixed in 6.64.0 (released Sep 15, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 7.5% of ghost downloads last week were affected versions (2.1K).

### [CVE-2026-103290](https://cve.now/CVE-2026-103290): Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize

- Severity: Medium 5.1
- Published: Oct 1, 2026
- Affected: from 6.14.0, fixed in 6.27.0.
- Fixed in 6.27.0 (released Apr 8, 2026, 176 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 3.1% of ghost downloads last week were affected versions (878).

### [CVE-2026-103289](https://cve.now/CVE-2026-103289): Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

- Severity: High 7.1
- Published: Oct 1, 2026
- Affected: from 5.9.0, fixed in 6.44.1.
- Fixed in 6.44.1 (released Jun 5, 2026, 118 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 48% of ghost downloads last week were affected versions (13.7K).

### [CVE-2026-103288](https://cve.now/CVE-2026-103288): Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

- Severity: High 7.1
- Published: Oct 1, 2026
- Affected: from 5.9.0, fixed in 6.44.1.
- Fixed in 6.44.1 (released Jun 5, 2026, 118 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 48% of ghost downloads last week were affected versions (13.7K).

### [CVE-2026-103287](https://cve.now/CVE-2026-103287): Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook

- Severity: Medium 5.1
- Published: Oct 1, 2026
- Affected: from 1.18.0, fixed in 6.27.0.
- Fixed in 6.27.0 (released Apr 8, 2026, 176 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 71% of ghost downloads last week were affected versions (20.3K).

### [CVE-2026-70596](https://cve.now/CVE-2026-70596): Ghost: Cross-Site Scripting in Feature Image Captions

- Severity: Medium 4.3
- Published: Aug 5, 2026
- Affected: from 4.9.0, fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 9 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 57% of ghost downloads last week were affected versions (16.3K).

### [CVE-2026-70595](https://cve.now/CVE-2026-70595): Ghost: Server-Side Request Forgery Mitigation Issue

- Severity: Medium 4.0
- Published: Aug 5, 2026
- Affected: from 6.26.0, fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 9 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 4.9% of ghost downloads last week were affected versions (1.4K).

### [CVE-2026-70594](https://cve.now/CVE-2026-70594): Ghost: Session Fixation in Ghost Admin

- Severity: Medium 6.7
- Published: Aug 4, 2026
- Affected: from 2.2.0, fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 71% of ghost downloads last week were affected versions (20.1K).

### [CVE-2026-70593](https://cve.now/CVE-2026-70593): Ghost: Theme Upload Path Traversal

- Severity: Medium 6.6
- Published: Aug 4, 2026
- Affected: from 0.10.0, fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 79% of ghost downloads last week were affected versions (22.6K).

### [CVE-2026-70592](https://cve.now/CVE-2026-70592): Ghost: Database Backup Path Traversal

- Severity: Medium 5.5
- Published: Aug 4, 2026
- Affected: from 1.20.1, fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 76% of ghost downloads last week were affected versions (21.5K).

### [CVE-2026-70591](https://cve.now/CVE-2026-70591): Ghost: Server-Side Request Forgery in Image Fetching

- Severity: Medium 4.1
- Published: Aug 4, 2026
- Affected: from 0.10.0, fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 79% of ghost downloads last week were affected versions (22.6K).

### [CVE-2026-70590](https://cve.now/CVE-2026-70590): Ghost: Blind Password Hash Disclosure in Ghost Admin API

- Severity: Medium 4.8
- Published: Aug 4, 2026
- Affected: fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 81% of ghost downloads last week were affected versions (23K).

### [CVE-2026-70589](https://cve.now/CVE-2026-70589): Ghost: Archived Offers can be Redeemed

- Severity: Medium 4.8
- Published: Aug 4, 2026
- Affected: from 4.22.0, fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 56% of ghost downloads last week were affected versions (15.8K).

### [CVE-2026-70588](https://cve.now/CVE-2026-70588): Ghost: Cross-Site Scripting in Universal Import

- Severity: Medium 5.0
- Published: Aug 4, 2026
- Affected: from 5.26.0, fixed in 6.54.1.
- Fixed in 6.54.1 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 47% of ghost downloads last week were affected versions (13.2K).

### [CVE-2026-59817](https://cve.now/CVE-2026-59817): Ghost: Paid gift memberships obtainable at minimal cost via the donations feature

- Severity: Medium 5.3
- Published: Jul 9, 2026
- Affected: from 6.27.0, fixed in 6.44.0.
- Fixed in 6.44.0 (released Jun 3, 2026, 36 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 2.6% of ghost downloads last week were affected versions (744).

### [CVE-2026-53943](https://cve.now/CVE-2026-53943): Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

- Severity: Critical 9.6
- Published: Jun 24, 2026
- Affected: from 4.0.0, fixed in 6.37.0.
- Fixed in 6.37.0 (released May 7, 2026, 48 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 56% of ghost downloads last week were affected versions (15.9K).

### [CVE-2026-53944](https://cve.now/CVE-2026-53944): Ghost: Private IP filtering bypass to make server-side requests to internal services

- Severity: Medium 5.8
- Published: Jun 24, 2026
- Affected: from 6.0.9, fixed in 6.21.1.
- Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure, the advisory names 6.21.1, which was never published).
- The latest release, 6.75.0, is not affected.
- 11% of ghost downloads last week were affected versions (3.3K).

### [CVE-2026-53945](https://cve.now/CVE-2026-53945): Ghost: Server-side request forgery via DNS rebinding in external request handling

- Severity: Medium 4.0
- Published: Jun 24, 2026
- Affected: from 6.0.9, fixed in 6.21.2.
- Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 11% of ghost downloads last week were affected versions (3.3K).

### [CVE-2026-53946](https://cve.now/CVE-2026-53946): Ghost: Mobiledoc image-size fetch SSRF

- Severity: Medium 5.4
- Published: Jun 24, 2026
- Affected: from 6.19.4, fixed in 6.21.2.
- Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 0.5% of ghost downloads last week were affected versions (136).

### [CVE-2026-53947](https://cve.now/CVE-2026-53947): Ghost: Member existence leak via magic link sign-in response

- Severity: Medium 5.3
- Published: Jun 24, 2026
- Affected: from 5.18.0, fixed in 6.21.2.
- Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 43% of ghost downloads last week were affected versions (12.2K).

### [CVE-2026-53948](https://cve.now/CVE-2026-53948): Ghost: File Upload Content-Type Spoofing

- Severity: Medium 5.4
- Published: Jun 24, 2026
- Affected: from 6.19.4, fixed in 6.21.1.
- Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure, the advisory names 6.21.1, which was never published).
- The latest release, 6.75.0, is not affected.
- 0.5% of ghost downloads last week were affected versions (136).

### [CVE-2026-53949](https://cve.now/CVE-2026-53949): Ghost Content API filter bypass reveals private fields

- Severity: Medium 5.3
- Published: Jun 24, 2026
- Affected: from 5.46.1, fixed in 6.21.2.
- Fixed in 6.21.2 (released Mar 10, 2026, 106 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 38% of ghost downloads last week were affected versions (10.8K).

### [CVE-2026-29784](https://cve.now/CVE-2026-29784): Ghost: Incomplete CSRF protections around OTC use

- Severity: High 7.5
- Published: Mar 7, 2026
- Affected: from 5.101.6, fixed in 6.19.3.
- Fixed in 6.19.3 (released Feb 26, 2026, 9 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 25% of ghost downloads last week were affected versions (7.1K).

### [CVE-2026-29053](https://cve.now/CVE-2026-29053): Ghost Vulnerable to Remote Code Execution via Malicious Themes

- Severity: High 7.7
- Published: Mar 5, 2026
- Affected: from 0.7.2, fixed in 6.19.1.
- Fixed in 6.19.1 (released Feb 16, 2026, 17 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 73% of ghost downloads last week were affected versions (20.9K).

### [CVE-2026-26980](https://cve.now/CVE-2026-26980): Ghost has a SQL Injection in its Content API

- Severity: Critical 9.4
- Published: Feb 20, 2026
- Affected: from 3.24.0, fixed in 6.19.1.
- Fixed in 6.19.1 (released Feb 16, 2026, 4 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 57% of ghost downloads last week were affected versions (16.1K).

### [CVE-2026-24778](https://cve.now/CVE-2026-24778): Ghost vulnerable to XSS via malicious Portal preview links

- Severity: High 8.8
- Published: Jan 27, 2026
- Affected: from 5.43.0, fixed in 5.121.0; from 6.0.0, fixed in 6.15.0.
- Fixed in 5.121.0 (released May 30, 2025, 242 days before disclosure) and 6.15.0 (released Jan 27, 2026, the day of disclosure).
- The latest release, 6.75.0, is not affected.
- 30% of ghost downloads last week were affected versions (8.4K).

### [CVE-2026-22597](https://cve.now/CVE-2026-22597): Ghost has SSRF via External Media Inliner

- Severity: Medium 5.1
- Published: Jan 10, 2026
- Affected: from 6.0.0, fixed in 6.11.0; from 5.105.0, fixed in 5.130.6.
- Fixed in 5.130.6 (released Jan 8, 2026, 2 days before disclosure) and 6.11.0 (released Jan 8, 2026, 2 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 19% of ghost downloads last week were affected versions (5.4K).

### [CVE-2026-22596](https://cve.now/CVE-2026-22596): Ghost has SQL Injection in Members Activity Feed

- Severity: Medium 6.7
- Published: Jan 10, 2026
- Affected: from 6.0.0, fixed in 6.11.0; from 5.105.0, fixed in 5.130.6.
- Fixed in 5.130.6 (released Jan 8, 2026, 2 days before disclosure) and 6.11.0 (released Jan 8, 2026, 2 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 19% of ghost downloads last week were affected versions (5.4K).

### [CVE-2026-22595](https://cve.now/CVE-2026-22595): Ghost has Staff Token permission bypass

- Severity: High 8.1
- Published: Jan 10, 2026
- Affected: from 6.0.0, fixed in 6.11.0; from 5.105.0, fixed in 5.130.6.
- Fixed in 5.130.6 (released Jan 8, 2026, 2 days before disclosure) and 6.11.0 (released Jan 8, 2026, 2 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 19% of ghost downloads last week were affected versions (5.4K).

### [CVE-2026-22594](https://cve.now/CVE-2026-22594): Ghost has Staff 2FA bypass

- Severity: High 8.1
- Published: Jan 10, 2026
- Affected: from 6.0.0, fixed in 6.11.0; from 5.105.0, fixed in 5.130.6.
- Fixed in 5.130.6 (released Jan 8, 2026, 2 days before disclosure) and 6.11.0 (released Jan 8, 2026, 2 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 19% of ghost downloads last week were affected versions (5.4K).

### [CVE-2025-9862](https://cve.now/CVE-2025-9862): Ghost 6.0.6 - SSRF via oEmbed Bookmark

- Severity: Medium 6.1
- Published: Sep 17, 2025
- Affected: from 6.0.0, fixed in 6.0.9; from 5.99.0, fixed in 5.130.4.
- Fixed in 5.130.4 (released Aug 12, 2025, 36 days before disclosure) and 6.0.9 (released Sep 14, 2025, 3 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 11% of ghost downloads last week were affected versions (3.1K).

### [CVE-2024-43409](https://cve.now/CVE-2024-43409): Ghost's improper authentication allows access to member information and actions

- Severity: Medium 6.5
- Published: Aug 20, 2024
- Affected: from 4.46.0, fixed in 5.89.5.
- Fixed in 5.89.5 (released Aug 20, 2024, the day of disclosure).
- The latest release, 6.75.0, is not affected.
- 19% of ghost downloads last week were affected versions (5.5K).

### [CVE-2024-23724](https://cve.now/CVE-2024-23724): Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG…

- Severity: Unrated
- Published: Feb 11, 2024
- Affected: through 5.76.0.
- Fixed in 5.76.1 (released Jan 22, 2024, 20 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 6.75.0, is not affected.
- 44% of ghost downloads last week were affected versions (12.4K).

### [CVE-2024-23725](https://cve.now/CVE-2024-23725): Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js.

- Severity: Medium 6.1
- Published: Jan 21, 2024
- Affected: fixed in 5.76.0.
- Fixed in 5.76.0 (released Jan 17, 2024, 4 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 43% of ghost downloads last week were affected versions (12.4K).

### [CVE-2023-40028](https://cve.now/CVE-2023-40028): Arbitrary file read via symlinks in Ghost

- Severity: Medium 4.9
- Published: Aug 15, 2023
- Affected: fixed in 5.59.1.
- Fixed in 5.59.1 (released Aug 15, 2023, the day of disclosure).
- The latest release, 6.75.0, is not affected.
- 40% of ghost downloads last week were affected versions (11.5K).

### [CVE-2023-31133](https://cve.now/CVE-2023-31133): Ghost vulnerable to disclosure of private API fields

- Severity: High 7.5
- Published: May 8, 2023
- Affected: fixed in 5.46.1.
- Fixed in 5.46.1 (released May 3, 2023, 5 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 37% of ghost downloads last week were affected versions (10.6K).

### [CVE-2023-32235](https://cve.now/CVE-2023-32235): Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/…

- Severity: High 7.5
- Published: May 5, 2023
- Affected: fixed in 5.42.1.
- Fixed in 5.42.1 (released Apr 7, 2023, 28 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 37% of ghost downloads last week were affected versions (10.5K).

### [CVE-2022-41654](https://cve.now/CVE-2022-41654): An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.

- Severity: Critical 9.6
- Published: Dec 23, 2022
- Affected: from 5.0.0, fixed in 5.22.7; from 4.46.0, fixed in 4.48.8.
- Fixed in 4.48.8 (released Nov 15, 2022, 38 days before disclosure) and 5.22.7 (released Nov 7, 2022, 46 days before disclosure).
- The latest release, 6.75.0, is not affected.
- 5% of ghost downloads last week were affected versions (1.4K).

### [CVE-2022-28397](https://cve.now/CVE-2022-28397): An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a…

- Severity: Unrated
- Published: Apr 12, 2022
- Affected: through 4.42.0.
- Fixed in 4.47.0 (released May 4, 2022, 22 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 6.75.0, is not affected.
- 28% of ghost downloads last week were affected versions (7.9K).

### [CVE-2022-27139](https://cve.now/CVE-2022-27139): An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted…

- Severity: Unrated
- Published: Apr 12, 2022
- Affected: through 4.39.0.
- Fixed in 4.47.0 (released May 4, 2022, 22 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 6.75.0, is not affected.
- 27% of ghost downloads last week were affected versions (7.8K).

### [CVE-2021-39192](https://cve.now/CVE-2021-39192): Privilege escalation: all users can access Admin-level API keys

- Severity: Medium 6.5
- Published: Sep 3, 2021
- Affected: from 4.0.0, fixed in 4.10.0.
- Fixed in 4.10.0.
- The latest release, 6.75.0, is not affected.
- 3% of ghost downloads last week were affected versions (854).

### [CVE-2021-29484](https://cve.now/CVE-2021-29484): DOM XSS in Theme Preview

- Severity: Medium 6.8
- Published: Apr 29, 2021
- Affected: from 4.0.0, fixed in 4.3.3.
- Fixed in 4.3.3.
- The latest release, 6.75.0, is not affected.
- 1.3% of ghost downloads last week were affected versions (375).

### [CVE-2020-8134](https://cve.now/CVE-2020-8134): Server-side request forgery (SSRF) vulnerability in Ghost CMS \< 3.10.0 allows an attacker to scan local or external network or otherwise…

- Severity: Unrated
- Published: Mar 20, 2020
- Affected: fixed in 3.10.0.
- Fixed in 3.10.0.
- The latest release, 6.75.0, is not affected.
- 16% of ghost downloads last week were affected versions (4.6K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/ghost
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.