CVE-2026-22597
Ghost has SSRF via External Media Inliner
Résumé
Ghost has SSRF via External Media Inliner
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
ghost
[{"type":"SEMVER","events":[{"introduced":"5.38.0"},{"fixed":"5.130.6"},{"introduced":"6.0.0"},{"fixed":"6.11.0"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com