{"id":"EUVD-2026-53388","enisaUuid":"a30c416c-7577-39d1-b226-f586bf9deb03","description":"Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server\u0027s internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.","datePublished":"Aug 5, 2026, 2:37:21 PM","dateUpdated":"Aug 6, 2026, 2:19:20 PM","baseScore":4.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-x5mm-wm4g-j5xv\n","aliases":"CVE-2026-70595\nGHSA-x5mm-wm4g-j5xv\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"fdc3dfc2-ee97-3ddd-8e0e-f2431c85d231","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"6.26.0, \u003c 6.54.1"}],"enisaIdVendor":[{"id":"a979ac4e-9abf-351a-a035-25dfbbe32708","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"7ebb4b94-4660-3b73-9a46-2ec290cf5a2d","vulnerability":{"id":"GHSA-x5mm-wm4g-j5xv","description":"Ghost: Server-Side Request Forgery Mitigation Issue","datePublished":"Aug 5, 2026, 2:37:14 PM","dateUpdated":"Aug 5, 2026, 2:37:14 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-x5mm-wm4g-j5xv\nhttps://github.com/TryGhost/Ghost\n","enisa_id":"EUVD-2026-53388\n","aliases":"GHSA-x5mm-wm4g-j5xv\nCVE-2026-70595\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:06 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e8b6e1e5-855f-3459-982a-28a6842ce7f6","vulnerability":{"id":"CVE-2026-70595","description":"Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server\u0027s internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.","datePublished":"Aug 5, 2026, 2:37:21 PM","dateUpdated":"Aug 6, 2026, 2:19:20 PM","status":"PUBLISHED","baseScore":4.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-x5mm-wm4g-j5xv\n","enisa_id":"EUVD-2026-53388\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Oct 28, 2026, 7:12:48 AM","vulnerabilityProduct":[{"id":"044b2888-6530-33c0-885a-034f7246a462","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"6.26.0, \u003c 6.54.1"}],"vulnerabilityVendor":[{"id":"403f9aa6-4c18-3eec-92e1-5340cd85fcd3","vendor":{"name":"TryGhost"}}]}}],"enisaIdAdvisory":[]}