{"metadata": {"vulnerability": "CVE-2026-70591", "count": 14, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-08-04T19:50:27.327Z", "date_only": false, "value": "2026-08-04T19:50:27.327Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-70591", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-04T21:37:53.766Z", "date_only": false, "value": "2026-08-04T21:37:53.766Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-70591", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-04T21:37:53.766Z", "date_only": false, "value": "2026-08-04T21:37:53.766Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-70591", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-04T21:38:17Z", "date_only": false, "value": "2026-08-04T21:38:17Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GCVV-72Q8-9V76", "record": "GHSA-GCVV-72Q8-9V76", "field": "published"}, {"timestamp": "2026-08-04T21:38:17Z", "date_only": false, "value": "2026-08-04T21:38:17Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GCVV-72Q8-9V76", "record": "GHSA-GCVV-72Q8-9V76", "field": "modified"}, {"timestamp": "2026-08-04T22:17:16.997Z", "date_only": false, "value": "2026-08-04T22:17:16.997", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70591", "record": "FKIE_CVE-2026-70591", "field": "published"}, {"timestamp": "2026-08-05T04:31:14.944Z", "date_only": false, "value": "2026-08-05T04:31:14.944586Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/f018a48cf6aafd68bd8bc1eabe897a46", "record": "CVE-2026-70591", "field": "creation_timestamp", "uuid": "0d27f17c-3814-46aa-9ef2-7f31fc14bdb6", "content": "# CVE-2026-70591: CVE-2026-70591: Server-Side Request Forgery in Ghost Admin Image Fetching\n\n> **CVSS Score:** 4.1\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70591\n\n## Summary\nA comprehensive technical analysis of CVE-2026-70591, a Server-Side Request Forgery (SSRF) vulnerability identified in the Ghost Content Management System. The flaw resides in the server-side image fetching mechanism of the ImageSize class, which allows authenticated, staff-level users to force the backend to perform unvalidated HTTP GET requests targeting local or private network services. This report provides an in-depth exploration of the root cause, vulnerable code structures, patch implementations, and mitigation steps.\n\n## TL;DR\nServer-Side Request Forgery (SSRF) in Ghost CMS (versions < 6.54.1) allows authenticated staff-level users to execute arbitrary HTTP GET requests targeting local or private network services through the admin console's image processing module.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.1 (Medium)\n- **Exploit Status**: PoC / Authenticated\n- **Impact**: Internal Reconnaissance / SSRF\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost Content Management System (Node.js)\n- **Ghost**: >= 0.10.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost to version 6.54.1 or higher\n- Implement egress filtering to block outgoing traffic to private IP spaces and link-local ranges\n- Enforce IMDSv2 on AWS-hosted instances to protect metadata services from blind SSRF\n\n**Remediation Steps:**\n1. Identify current running Ghost instance version.\n2. Execute update commands through Ghost CLI: `ghost update 6.54.1`.\n3. Confirm the service is running the updated version: `ghost version`.\n4. Implement firewall egress rules (e.g., iptables) restricting the Ghost service user from connecting to localhost and private interfaces.\n\n## References\n\n- [GitHub Security Advisory GHSA-gcvv-72q8-9v76](https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76)\n- [CVE-2026-70591 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-70591)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70591) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/f018a48cf6aafd68bd8bc1eabe897a46"}, {"timestamp": "2026-08-05T14:14:58.079Z", "date_only": false, "value": "2026-08-05T14:14:58.079494Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70591", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-05T14:14:58.079Z", "date_only": false, "value": "2026-08-05T14:14:58.079494Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70591", "record": "FKIE_CVE-2026-70591", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-05T14:15:07.201Z", "date_only": false, "value": "2026-08-05T14:15:07.201Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-70591", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-05T14:15:07.201Z", "date_only": false, "value": "2026-08-05T14:15:07.201Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70591", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-17T05:40:59.968Z", "date_only": false, "value": "2026-08-17T05:40:59.968Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-GHOST-2026-70591", "record": "BIT-GHOST-2026-70591", "field": "published"}, {"timestamp": "2026-08-17T06:10:32.268Z", "date_only": false, "value": "2026-08-17T06:10:32.268Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-GHOST-2026-70591", "record": "BIT-GHOST-2026-70591", "field": "modified"}, {"timestamp": "2026-10-24T15:10:00.190Z", "date_only": false, "value": "2026-10-24T15:10:00.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70591", "record": "FKIE_CVE-2026-70591", "field": "lastModified"}]}