CVE-2026-70595

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.

• CWE-918

• https://github.com/TryGhost/Ghost/security/advisories/GHSA-x5mm-wm4g-j5xv

Published

Aug 5, 2026

Last Modified

Aug 6, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7059A vulnerability was found in 666ghj MiroFish up to 0.1.2. Th…5.5
• CVE-2026-70590Ghost is a Node.js content management system. Prior to 6.54.…4.8
• CVE-2026-70591Ghost is a Node.js content management system. From 0.10.0 un…4.1
• CVE-2026-70592Ghost is a Node.js content management system. From 1.20.1 un…5.5
• CVE-2026-70593Ghost is a Node.js content management system. From 0.10.0 un…6.6
• CVE-2026-70594Ghost is a Node.js content management system. From 2.2.0 unt…6.7
• CVE-2026-70596Ghost is a Node.js content management system. From 4.9.0 unt…4.3
• CVE-2026-70597Electron is a framework for writing cross-platform desktop a…6.3
• CVE-2026-70598Electron is a framework for writing cross-platform desktop a…3.9
• CVE-2026-70599Electron is a framework for writing cross-platform desktop a…5.9
• CVE-2026-7060A vulnerability was determined in liyupi yu-picture up to a0…7.3
• CVE-2026-70600Electron is a framework for writing cross-platform desktop a…3.1