CVE-2026-70591: Ghost: Server-Side Request Forgery in Image Fetching

August 4, 2026

A Server-Side Request Forgery (SSRF) in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts.

References

github.com/TryGhost/Ghost/commit/5eff2de0f477b11c88f20bceb9d184c0d3b8a62e
github.com/TryGhost/Ghost/releases/tag/v6.54.1
github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76
github.com/advisories/GHSA-gcvv-72q8-9v76
nvd.nist.gov/vuln/detail/CVE-2026-70591

Code Behaviors & Features

Detect and mitigate CVE-2026-70591 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →