ghost@6.50.0

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Universal Import process. An attacker can inject malicious scripts into post content by importing specially crafted data.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the comments and Webmentions URL resolution in comments-service-emails.js and comments.js. An attacker can make the server issue limited HTTP requests to hosts on the Ghost instance’s internal network by supplying content that resolves to a page-backed comment or mention URL. A successful request does not return response data, but it can still be used to probe internal services reachable from the Ghost server.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the selectedRevision path in the post history modal and feature image caption rendering code. An attacker can execute script in another staff user’s Admin session by creating or editing a post with a crafted feature_image_caption that is later viewed in post revision history or context rendering. When Ghost Admin renders the revision preview, the caption is treated as HTML without sanitization, so attacker-controlled markup is preserved and displayed to staff users. This can hijack an admin session and let the attacker act with the victim’s privileges.

Notes

• The vulnerable rendering path is in Ghost Admin’s post history modal and the corresponding context-resource rendering used by the admin UI; it affects staff-facing preview surfaces, not the public theme layer.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Improper Authorization in RouterController._getSubscriptionCheckoutData through the subscription offer redemption flow in core/server/controllers/router.js. An attacker can redeem an archived or otherwise inactive subscription offer by submitting its offerId during checkout. This lets users obtain subscription benefits from offers that are no longer active, bypassing the intended offer lifecycle and allowing expired or archived promotions to be redeemed.

Notes

• The vulnerable path accepts any offer object returned by offersAPI.getOffer; the inactive-offer check is only relevant when the offer record still carries a status field, so offers without a status value were not constrained by this validation point.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the ImageSize._fetchImageSizeFromUrl path in core/server/lib/image/image-size.js. An attacker can make Ghost send blind HTTP GET requests to internal hosts by supplying an external image URL that is fetched for image-size detection. This lets a staff-level user probe internal services and open ports from the Ghost server, with no response body returned to the attacker.

Notes

• Staff-level access in Ghost Admin is required; the vulnerable image-size lookup is reachable through the admin-side image handling flow rather than public site requests.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Information Exposure via the posts and pages browse and export filtering paths in PostsService, PostsExporter, and the posts/pages admin controllers. An attacker can leak other staff users’ password hashes by sending an admin API request with a crafted filter such as authors.password:abcd on /posts, /posts/export, or /pages.

Notes

• The leak only applies to staff-admin requests that use the admin API browse/export filter syntax on posts or pages; the maintainer advisory says the hashes were exposed to any staff-level user.

Workarounds

• Enable Multi-factor Authentication (MFA) for all staff users to reduce the chance that a recovered password hash can be used to log in and take over an account.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Directory Traversal through the theme upload validation in services/themes/storage.js and LocalStorageBase.ts. An attacker can write files outside the uploads directory by uploading a custom theme with a name that resolves to path elements such as . or .., causing the storage code to accept a target path outside the intended theme directory. This lets a staff user place files elsewhere on disk and alter the behavior of the installation.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Session Fixation due to the createSessionForUser logic in ghost/core/core/server/services/auth/session/session-service.js. An attacker can reuse a pre-set session identifier by getting a victim to authenticate on the same Ghost Admin domain, causing the victim’s login to bind to an attacker-known session. This lets the attacker hijack the authenticated admin session after login and act as that user, exposing admin access and any data or actions available in Ghost Admin.

Upgrade ghost to version 6.54.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Access Restriction Bypass that allows contributors to view draft posts of other users via the /ghost/api/admin/posts endpoint and draft pages of other users via the /ghost/api/admin/pages endpoint.

NOTE: The vendor's position is that this behavior has no security impact.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the codeinjection_foot field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the codeinjection_head field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the facebook field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.