CVE-2025-9862

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

• CWE-918

• https://fluidattacks.com/advisories/regidaExploit, Third Party Advisory
• https://github.com/TryGhost/GhostProduct
• https://github.com/TryGhost/Ghost/releases/tag/v6.0.9Patch
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-f7qg-xj45-w956Third Party Advisory
• https://fluidattacks.com/advisories/regidaExploit, Third Party Advisory

Published

Sep 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9856The Popup Builder – Create highly converting, mobile friendl…6.4
• CVE-2025-9857The Heateor Login – Social Login Plugin plugin for WordPress…6.4
• CVE-2025-9858The Auto Bulb Finder for WordPress plugin for WordPress is v…6.4
• CVE-2025-9859The Fintelligence Calculator plugin for WordPress is vulnera…6.4
• CVE-2025-9860The Mixtape plugin for WordPress is vulnerable to Stored Cro…6.4
• CVE-2025-9861The ThemeLoom Widgets plugin for WordPress is vulnerable to …6.4
• CVE-2025-9864Rejected reason: This CVE ID was assigned in error to a vuln…
• CVE-2025-9865Inappropriate implementation in Toolbar in Google Chrome on …5.4
• CVE-2025-9866Inappropriate implementation in Extensions in Google Chrome …8.8
• CVE-2025-9867Inappropriate implementation in Downloads in Google Chrome o…5.4
• CVE-2025-9868Server-Side Request Forgery (SSRF) in the Remote Browser Plu…8.7
• CVE-2025-9869Razer Synapse 3 Macro Module Link Following Local Privilege …7.8