Bitnami package
ghost
pkg:bitnami/ghost
Vulnerabilities (103)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-103280 | Med | 5.3 | >= 0.8.0, < 6.23.0 | 6.23.0 | Oct 1, 2026 | Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it. | |
| CVE-2026-103279 | Med | 6.8 | >= 3.10.0, < 6.34.0 | 6.34.0 | Oct 1, 2026 | Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password. | |
| CVE-2026-103278 | Hig | 7.3 | >= 5.8.0, < 6.34.0 | 6.34.0 | Oct 1, 2026 | Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account | |
| CVE-2026-103277 | Hig | 8.1 | >= 2.5.0, < 6.34.0 | 6.34.0 | Oct 1, 2026 | Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin sessio | |
| CVE-2026-103276 | Med | 5.3 | < 6.20.0 | 6.20.0 | Oct 1, 2026 | Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files. | |
| CVE-2026-103275 | Med | 4.3 | >= 5.42.2, < 6.58.0 | 6.58.0 | Oct 1, 2026 | Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers ca | |
| CVE-2026-103274 | Med | 5.3 | >= 5.3.0, < 6.58.0 | 6.58.0 | Oct 1, 2026 | Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings. | |
| CVE-2026-103273 | Med | 4.3 | >= 4.3.0, < 6.58.0 | 6.58.0 | Oct 1, 2026 | Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level. | |
| CVE-2026-103272 | Hig | 7.5 | >= 2.10.0, < 6.63.0 | 6.63.0 | Oct 1, 2026 | Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive informatio | |
| CVE-2026-103271 | Hig | 7.5 | >= 4.0.0, < 6.63.0 | 6.63.0 | Oct 1, 2026 | Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication. | |
| CVE-2026-103269 | Med | 5.3 | >= 5.3.0, < 6.62.0 | 6.62.0 | Oct 1, 2026 | Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content). | |
| CVE-2026-103268 | Hig | 8.8 | >= 1.0.0, < 6.62.0 | 6.62.0 | Oct 1, 2026 | Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active accoun | |
| CVE-2026-103267 | Med | 4.3 | >= 0.5.0, < 6.62.0 | 6.62.0 | Oct 1, 2026 | Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate rec | |
| CVE-2026-103266 | Hig | 7.1 | >= 5.2.0, < 6.62.0 | 6.62.0 | Oct 1, 2026 | Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Dependi | |
| CVE-2026-70596 | Med | 4.3 | >= 4.9.0, < 6.54.1 | 6.54.1 | Aug 5, 2026 | Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. | |
| CVE-2026-70595 | Med | 4.0 | >= 6.26.0, < 6.54.1 | 6.54.1 | Aug 5, 2026 | Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack w | |
| CVE-2026-70594 | Med | 6.7 | >= 2.2.0, < 6.54.1 | 6.54.1 | Aug 4, 2026 | Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost | |
| CVE-2026-70593 | Med | 6.6 | >= 0.10.0, < 6.54.1 | 6.54.1 | Aug 4, 2026 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal i | |
| CVE-2026-70592 | Med | 5.5 | >= 1.20.1, < 6.54.1 | 6.54.1 | Aug 4, 2026 | Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to | |
| CVE-2026-70591 | Med | 4.1 | >= 0.10.0, < 6.54.1 | 6.54.1 | Aug 4, 2026 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to pr |
- affected >= 0.8.0, < 6.23.0fixed 6.23.0
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.
- affected >= 3.10.0, < 6.34.0fixed 6.34.0
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.
- affected >= 5.8.0, < 6.34.0fixed 6.34.0
Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account
- affected >= 2.5.0, < 6.34.0fixed 6.34.0
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin sessio
- affected < 6.20.0fixed 6.20.0
Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files.
- affected >= 5.42.2, < 6.58.0fixed 6.58.0
Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers ca
- affected >= 5.3.0, < 6.58.0fixed 6.58.0
Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings.
- affected >= 4.3.0, < 6.58.0fixed 6.58.0
Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level.
- affected >= 2.10.0, < 6.63.0fixed 6.63.0
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive informatio
- affected >= 4.0.0, < 6.63.0fixed 6.63.0
Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication.
- affected >= 5.3.0, < 6.62.0fixed 6.62.0
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content).
- affected >= 1.0.0, < 6.62.0fixed 6.62.0
Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active accoun
- affected >= 0.5.0, < 6.62.0fixed 6.62.0
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate rec
- affected >= 5.2.0, < 6.62.0fixed 6.62.0
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Dependi
- affected >= 4.9.0, < 6.54.1fixed 6.54.1
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation.
- affected >= 6.26.0, < 6.54.1fixed 6.54.1
Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack w
- affected >= 2.2.0, < 6.54.1fixed 6.54.1
Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost
- affected >= 0.10.0, < 6.54.1fixed 6.54.1
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal i
- affected >= 1.20.1, < 6.54.1fixed 6.54.1
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to
- affected >= 0.10.0, < 6.54.1fixed 6.54.1
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to pr
Page 3 of 6