Medium severity4.3NVD Advisory· Published Oct 1, 2026

CVE-2026-103285

Description

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when visited by authenticated members without their knowledge or consent.

Affected products

Ghostty/Ghosttyllm-fuzzy
Range: from 5.19.0 before 6.57.1

Patches

Vulnerability mechanics

References

github.com/TryGhost/Ghost/security/advisories/GHSA-mf3j-vxq2-vmc4nvd
www.vulncheck.com/advisories/ghost-5.19.0-before-6.57.1-cross-site-request-forgerynvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000