CVE-2026-53946— Ghost: Mobiledoc image-size fetch SSRF
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53946
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghost: Mobiledoc image-size fetch SSRF
Source: NVD (National Vulnerability Database)
Vulnerability Description
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-53946
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53946
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53946 (1)
- 🔗 Mobiledoc image-size fetch SSRF · Advisory · TryGhost/Ghost · GitHubx_refsource_CONFIRM
Same Patch Batch · TryGhost · 2026-06-24 · 8 CVEs total
| CVE-2026-53943 | 9.6 CRITICAL | Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header |
| CVE-2026-53950 | 7.5 HIGH | @tryghost/activitypub: XSS in Ghost's ActivityPub client |
| CVE-2026-53944 | 5.8 MEDIUM | Ghost: Private IP filtering bypass to make server-side requests to internal services |
| CVE-2026-53948 | 5.4 MEDIUM | Ghost: File Upload Content-Type Spoofing |
| CVE-2026-53947 | 5.3 MEDIUM | Ghost: Member existence leak via magic link sign-in response |
| CVE-2026-53949 | 5.3 MEDIUM | Ghost Content API filter bypass reveals private fields |
| CVE-2026-53945 | 4.0 MEDIUM | Ghost: Server-side request forgery via DNS rebinding in external request handling |
IV. Related Vulnerabilities
Same product: Ghost
- CVE-2026-53943
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-pre - CVE-2026-53944
Ghost: Private IP filtering bypass to make server-side reque - CVE-2026-53945
Ghost: Server-side request forgery via DNS rebinding in exte - CVE-2026-53947
Ghost: Member existence leak via magic link sign-in response - CVE-2026-53948
Ghost: File Upload Content-Type Spoofing
Same vendor: TryGhost
- CVE-2026-53943
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-pre - CVE-2026-53944
Ghost: Private IP filtering bypass to make server-side reque - CVE-2026-53945
Ghost: Server-side request forgery via DNS rebinding in exte - CVE-2026-53947
Ghost: Member existence leak via magic link sign-in response - CVE-2026-53948
Ghost: File Upload Content-Type Spoofing
Same weakness: CWE-918
- CVE-2026-10055
Eclipse Theia 1.26.0+ SSRF漏洞 - CVE-2026-11397
WP Import Export Lite <= 3.9.30 - Authenticated (Administrat - CVE-2026-45499
Azure OpenAI Elevation of Privilege Vulnerability - CVE-2026-57100
Microsoft Entra Provisioning Service Elevation of Privilege - CVE-2026-59101
AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader
V. Comments for CVE-2026-53946
No comments yet