Vulnerabilities CVE-2026-70591

CVE-2026-70591

Medium

Open

TLP:CLEAR

Ghost: Server-Side Request Forgery in Image Fetching

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.

Details

CVSS Score: 4.1
EPSS Score ⓘ: 0.23%

13.6th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Confidence: 90%
Published: Aug 4, 2026
Last Modified: Aug 5, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.