CVE-2026-70591

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-70591

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70591.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-70591

Aliases

Published

2026-08-04T21:37:53Z

Modified

2026-09-10T03:30:49Z

Severity

4.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

Ghost: Server-Side Request Forgery in Image Fetching

Details

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70591.json"
}

References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type

GIT

Repo

https://github.com/tryghost/ghost

Events

Introduced

d56734d71119553ee661b00c08e3e192fc52f826

Fixed

5eff2de0f477b11c88f20bceb9d184c0d3b8a62e

Fixed

94e25d9de158bc10b6a74d9aad75944b1a68ee13

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.10.0"
        },
        {
            "fixed": "6.54.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70591.json"