CVE-2026-22596
Ghost has SQL Injection in Members Activity Feed
Résumé
Ghost has SQL Injection in Members Activity Feed
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
ghost
[{"type":"SEMVER","events":[{"introduced":"5.90.0"},{"fixed":"5.130.6"},{"introduced":"6.0.0"},{"fixed":"6.11.0"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com