CVE-2026-70591

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70591", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-04T19:50:27.327Z", "datePublished": "2026-08-04T21:37:53.766Z", "dateUpdated": "2026-08-05T14:15:07.201Z"}, "containers": {"cna": {"title": "Ghost: Server-Side Request Forgery in Image Fetching", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76"}, {"name": "https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e", "tags": ["x_refsource_MISC"], "url": "https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e"}, {"name": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1"}], "affected": [{"vendor": "TryGhost", "product": "Ghost", "versions": [{"version": ">= 0.10.0, < 6.54.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-04T21:37:53.766Z"}, "descriptions": [{"lang": "en", "value": "Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1."}], "source": {"advisory": "GHSA-gcvv-72q8-9v76", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T14:14:58.079494Z", "id": "CVE-2026-70591", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T14:15:07.201Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70591", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T14:14:58.079494Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T14:15:01.832Z"}}], "cna": {"title": "Ghost: Server-Side Request Forgery in Image Fetching", "source": {"advisory": "GHSA-gcvv-72q8-9v76", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "TryGhost", "product": "Ghost", "versions": [{"status": "affected", "version": ">= 0.10.0, < 6.54.1"}]}], "references": [{"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76", "name": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e", "name": "https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1", "name": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-04T21:37:53.766Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70591", "state": "PUBLISHED", "dateUpdated": "2026-08-05T14:15:07.201Z", "dateReserved": "2026-08-04T19:50:27.327Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-04T21:37:53.766Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Ghost", "vendor": "TryGhost", "versions": [{"status": "affected", "version": ">= 0.10.0, < 6.54.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1."}, {"lang": "es", "value": "Ghost es un sistema de gesti\u00f3n de contenido Node.js. Desde 0.10.0 hasta 6.54.1, una falsificaci\u00f3n de petici\u00f3n del lado del servidor en la obtenci\u00f3n de im\u00e1genes de Ghost Admin permit\u00eda a cualquier usuario con nivel de personal realizar una petici\u00f3n HTTP GET ciega contra hosts internos. No se devolv\u00eda ninguna salida, pero esto podr\u00eda haberse utilizado para sondear puertos abiertos en hosts internos. Este problema est\u00e1 solucionado en la versi\u00f3n 6.54.1."}], "id": "CVE-2026-70591", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70591", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T14:14:58.079494Z", "version": "2.0.3"}}]}, "published": "2026-08-04T22:17:16.997", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e"}, {"source": "security-advisories@github.com", "url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.10.0,6.54.1)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Ghost", "source": "cna", "vendor": "TryGhost"}, "product": "ghost", "vendor": "ghost"}], "created": "2026-08-04T23:45:02.942660+00:00", "updated": "2026-08-05T09:30:11.499797+00:00", "vendors": ["ghost", "ghost$PRODUCT$ghost"]}