{"uuid": "49bc7bbc-3200-4f79-a8e9-4e010ed81a84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-g366-23fw-ggp6", "type": "seen", "source": "https://gist.github.com/alon710/12c62bdb45c24ef118204a5bc7818a85", "content": "# CVE-2026-53946: CVE-2026-53946: Server-Side Request Forgery in Ghost CMS Mobiledoc Processing Workflow\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53946\n\n## Summary\nA Server-Side Request Forgery (SSRF) vulnerability exists in the Mobiledoc post-rendering component of Ghost CMS versions 6.19.4 through 6.21.0. This allows authenticated staff users with post creation or editing privileges to force the application server to perform arbitrary outbound HTTP GET requests, targeting internal endpoints, local loopback interfaces, or cloud metadata endpoints.\n\n## TL;DR\nMedium-severity SSRF in Ghost CMS (v6.19.4 - v6.21.0) allows authenticated authors/editors to abuse image dimension parsing to probe internal services and access cloud metadata servers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00122 (~2.31% probability of exploitation)\n- **Impact**: Unauthorized retrieval of internal server and metadata resources\n- **Exploit Status**: Proof-of-Concept / Code-level analysis\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 6.19.4, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or above\n- Implement outbound firewall rules to prevent Ghost from contacting private subnets (RFC 1918) and cloud instance metadata services (169.254.169.254)\n\n**Remediation Steps:**\n1. Verify the current running version of Ghost CMS in your administration dashboard or command-line interface.\n2. Upgrade the application by running the upgrade sequence using the Ghost CLI utility: `ghost update`.\n3. Review network security group rules on your cloud virtual machine to isolate outbound communication from the application instance.\n4. Audit active user profiles within your Ghost settings and downgrade permissions for any untrusted or obsolete staff accounts.\n\n## References\n\n- [CVE.org Record Page](https://www.cve.org/CVERecord?id=CVE-2026-53946)\n- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2026-53946)\n- [GitHub Advisory Database Record](https://github.com/TryGhost/Ghost/security/advisories/GHSA-g366-23fw-ggp6)\n- [Ghost v6.21.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53946) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T06:32:52.174200Z"}