CVE-2026-53946
Description
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.
Summary dbcve.org
Ghost CMS versions 6.19.4 through 6.21.1 contain an authenticated Server-Side Request Forgery (SSRF) vulnerability. When re-rendering posts with image cards that have missing dimensions, Ghost issues outbound HTTP requests to fetch those dimensions without validating that the URL points to a trusted image host. An authenticated staff user with post create/edit permissions can exploit this by setting an image URL to internal network hosts or cloud metadata endpoints (e.g., 169.254.169.254), allowing enumeration of internal infrastructure.
Mitigation
Upgrade Ghost to version 6.21.1 or later. If immediate upgrade is not feasible, consider restricting outbound network access from the Ghost server and monitoring for suspicious requests to internal IP ranges or metadata endpoints.