CVE-2026-53946

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.

• CWE-918

• https://github.com/TryGhost/Ghost/security/advisories/GHSA-g366-23fw-ggp6

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53931NocoDB is software for building databases as spreadsheets. P…6.9
• CVE-2026-53935Cilium is a networking, observability, and security solution…6.9
• CVE-2026-5394An authenticated administrative user who can import or save …7
• CVE-2026-53943Ghost is a Node.js content management system. From until 6.…9.6
• CVE-2026-53944Ghost is a Node.js content management system. From 6.0.9 unt…5.8
• CVE-2026-53945Ghost is a Node.js content management system. From 6.0.9 unt…4
• CVE-2026-53947Ghost is a Node.js content management system. From 5.18.0 un…5.3
• CVE-2026-53948Ghost is a Node.js content management system. From 6.19.4 un…5.4
• CVE-2026-53949Ghost is a Node.js content management system. From 5.46.1 un…5.3
• CVE-2026-5395The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…8.2
• CVE-2026-53950@tryghost/activitypub is Ghost’s social/federation client ap…7.5
• CVE-2026-53951Copier is a library and CLI app for rendering project templa…8.8