CVE-2026-70595 MEDIUM

CVE-2026-70595: Ghost: Server-Side Request Forgery Mitigation Issue

Vendor Tryghost

Product Ghost

Weakness CWE-918 · SSRF

Published August 5, 2026

Last update August 5, 2026

View on NVD All CVEs

CVSS base score

4.0/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.

Key dates

02Disclosure timeline

August 5, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-70595 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html AskarLabs — CWE-918 write-up Server-Side Request Forgery

Related vulnerabilities

04Related CVE

CVE-2026-39695 WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-46698 Fediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX action CVE-2026-39647 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-60175 WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability CVE-2026-24964 WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability