DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-70591: CVE-2026-70591: Server-Side Request Forgery in Ghost Admin Image Fetching

#security #cve #cybersecurity

CVE-2026-70591: Server-Side Request Forgery in Ghost Admin Image Fetching

Vulnerability ID: CVE-2026-70591
CVSS Score: 4.1
Published: 2026-08-04

A comprehensive technical analysis of CVE-2026-70591, a Server-Side Request Forgery (SSRF) vulnerability identified in the Ghost Content Management System. The flaw resides in the server-side image fetching mechanism of the ImageSize class, which allows authenticated, staff-level users to force the backend to perform unvalidated HTTP GET requests targeting local or private network services. This report provides an in-depth exploration of the root cause, vulnerable code structures, patch implementations, and mitigation steps.

TL;DR

Server-Side Request Forgery (SSRF) in Ghost CMS (versions < 6.54.1) allows authenticated staff-level users to execute arbitrary HTTP GET requests targeting local or private network services through the admin console's image processing module.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network (AV:N)
  • CVSS Score: 4.1 (Medium)
  • Exploit Status: PoC / Authenticated
  • Impact: Internal Reconnaissance / SSRF
  • KEV Status: Not Listed

Affected Systems

  • Ghost Content Management System (Node.js)
  • Ghost: >= 0.10.0, < 6.54.1 (Fixed in: 6.54.1)

Code Analysis

Commit: 5eff2de

Refactor ImageSize to use externalRequest client (fetchExternal) rather than an unvalidated request wrapper to fix SSRF vulnerability.

Mitigation Strategies

  • Upgrade Ghost to version 6.54.1 or higher
  • Implement egress filtering to block outgoing traffic to private IP spaces and link-local ranges
  • Enforce IMDSv2 on AWS-hosted instances to protect metadata services from blind SSRF

Remediation Steps:

  1. Identify current running Ghost instance version.
  2. Execute update commands through Ghost CLI: ghost update 6.54.1.
  3. Confirm the service is running the updated version: ghost version.
  4. Implement firewall egress rules (e.g., iptables) restricting the Ghost service user from connecting to localhost and private interfaces.

References

Read the full report for CVE-2026-70591 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)