https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 14 Sep 2026 20:35:53 +0000 https://vulnerability.circl.lu/sighting/8b1cc76d-64cb-491b-b0dd-4a8805e246ae/export {"uuid": "8b1cc76d-64cb-491b-b0dd-4a8805e246ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70590", "type": "seen", "source": "https://gist.github.com/alon710/0b530d759c455a262a40add3fda52d22", "content": "# CVE-2026-70590: CVE-2026-70590: Blind Password Hash Disclosure in TryGhost Ghost Admin API via Insecure Filter Mapping\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70590\n\n## Summary\nAn authenticated staff-level user can perform a side-channel, boolean-based blind database query attack through the Ghost Admin API to systematically extract the hashed passwords (bcrypt) of other staff users, including administrators, due to insecure filter mapping.\n\n## TL;DR\nAuthenticated staff-level users can exploit insecure nested filter mapping in the Ghost Admin API to extract bcrypt password hashes of other users, including administrators, via boolean-based blind SQL side-channel queries.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N)\n- **CVSS Score**: 4.8\n- **EPSS Score**: 0.0\n- **Impact**: Information Disclosure (Password Hashes)\n- **Exploit Status**: None (No public weaponized exploit)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost (TryGhost/Ghost) CMS\n- **Ghost**: < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Immediate upgrade to Ghost version 6.54.1 or newer.\n- Implement WAF rules to drop or block URI query parameters containing password-related strings on administrative endpoints.\n\n**Remediation Steps:**\n1. Identify all deployed self-hosted Ghost instances.\n2. Execute the 'ghost update' command via Ghost-CLI to upgrade instances to version 6.54.1 or above.\n3. Deploy temporary WAF filters to inspect and block malicious Admin API query strings targeting critical backend properties.\n4. Review Ghost access logs for unexpected iterative queries containing relational parameters.\n\n## References\n\n- [GitHub Security Advisory GHSA-jm22-3w23-5q7w](https://github.com/TryGhost/Ghost/security/advisories/GHSA-jm22-3w23-5q7w)\n- [Fix Commit](https://github.com/TryGhost/Ghost/commit/63c31fad7e473caa62d8fbb4651a04a2a62b5d00)\n- [Pull Request #29628](https://github.com/TryGhost/Ghost/pull/29628)\n- [Release Tag v6.54.1](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n- [CVE Registry Record](https://www.cve.org/CVERecord?id=CVE-2026-70590)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70590) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T05:32:02.107633Z"} {"uuid": "8b1cc76d-64cb-491b-b0dd-4a8805e246ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70590", "type": "seen", "source": "https://gist.github.com/alon710/0b530d759c455a262a40add3fda52d22", "content": "# CVE-2026-70590: CVE-2026-70590: Blind Password Hash Disclosure in TryGhost Ghost Admin API via Insecure Filter Mapping\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70590\n\n## Summary\nAn authenticated staff-level user can perform a side-channel, boolean-based blind database query attack through the Ghost Admin API to systematically extract the hashed passwords (bcrypt) of other staff users, including administrators, due to insecure filter mapping.\n\n## TL;DR\nAuthenticated staff-level users can exploit insecure nested filter mapping in the Ghost Admin API to extract bcrypt password hashes of other users, including administrators, via boolean-based blind SQL side-channel queries.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N)\n- **CVSS Score**: 4.8\n- **EPSS Score**: 0.0\n- **Impact**: Information Disclosure (Password Hashes)\n- **Exploit Status**: None (No public weaponized exploit)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost (TryGhost/Ghost) CMS\n- **Ghost**: < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Immediate upgrade to Ghost version 6.54.1 or newer.\n- Implement WAF rules to drop or block URI query parameters containing password-related strings on administrative endpoints.\n\n**Remediation Steps:**\n1. Identify all deployed self-hosted Ghost instances.\n2. Execute the 'ghost update' command via Ghost-CLI to upgrade instances to version 6.54.1 or above.\n3. Deploy temporary WAF filters to inspect and block malicious Admin API query strings targeting critical backend properties.\n4. Review Ghost access logs for unexpected iterative queries containing relational parameters.\n\n## References\n\n- [GitHub Security Advisory GHSA-jm22-3w23-5q7w](https://github.com/TryGhost/Ghost/security/advisories/GHSA-jm22-3w23-5q7w)\n- [Fix Commit](https://github.com/TryGhost/Ghost/commit/63c31fad7e473caa62d8fbb4651a04a2a62b5d00)\n- [Pull Request #29628](https://github.com/TryGhost/Ghost/pull/29628)\n- [Release Tag v6.54.1](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n- [CVE Registry Record](https://www.cve.org/CVERecord?id=CVE-2026-70590)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70590) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T05:32:02.107633Z"} https://vulnerability.circl.lu/sighting/8b1cc76d-64cb-491b-b0dd-4a8805e246ae/export Wed, 05 Aug 2026 05:32:02 +0000 https://vulnerability.circl.lu/sighting/0d27f17c-3814-46aa-9ef2-7f31fc14bdb6/export {"uuid": "0d27f17c-3814-46aa-9ef2-7f31fc14bdb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70591", "type": "seen", "source": "https://gist.github.com/alon710/f018a48cf6aafd68bd8bc1eabe897a46", "content": "# CVE-2026-70591: CVE-2026-70591: Server-Side Request Forgery in Ghost Admin Image Fetching\n\n> **CVSS Score:** 4.1\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70591\n\n## Summary\nA comprehensive technical analysis of CVE-2026-70591, a Server-Side Request Forgery (SSRF) vulnerability identified in the Ghost Content Management System. The flaw resides in the server-side image fetching mechanism of the ImageSize class, which allows authenticated, staff-level users to force the backend to perform unvalidated HTTP GET requests targeting local or private network services. This report provides an in-depth exploration of the root cause, vulnerable code structures, patch implementations, and mitigation steps.\n\n## TL;DR\nServer-Side Request Forgery (SSRF) in Ghost CMS (versions < 6.54.1) allows authenticated staff-level users to execute arbitrary HTTP GET requests targeting local or private network services through the admin console's image processing module.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.1 (Medium)\n- **Exploit Status**: PoC / Authenticated\n- **Impact**: Internal Reconnaissance / SSRF\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost Content Management System (Node.js)\n- **Ghost**: >= 0.10.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost to version 6.54.1 or higher\n- Implement egress filtering to block outgoing traffic to private IP spaces and link-local ranges\n- Enforce IMDSv2 on AWS-hosted instances to protect metadata services from blind SSRF\n\n**Remediation Steps:**\n1. Identify current running Ghost instance version.\n2. Execute update commands through Ghost CLI: `ghost update 6.54.1`.\n3. Confirm the service is running the updated version: `ghost version`.\n4. Implement firewall egress rules (e.g., iptables) restricting the Ghost service user from connecting to localhost and private interfaces.\n\n## References\n\n- [GitHub Security Advisory GHSA-gcvv-72q8-9v76](https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76)\n- [CVE-2026-70591 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-70591)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70591) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T04:31:14.944586Z"} {"uuid": "0d27f17c-3814-46aa-9ef2-7f31fc14bdb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70591", "type": "seen", "source": "https://gist.github.com/alon710/f018a48cf6aafd68bd8bc1eabe897a46", "content": "# CVE-2026-70591: CVE-2026-70591: Server-Side Request Forgery in Ghost Admin Image Fetching\n\n> **CVSS Score:** 4.1\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70591\n\n## Summary\nA comprehensive technical analysis of CVE-2026-70591, a Server-Side Request Forgery (SSRF) vulnerability identified in the Ghost Content Management System. The flaw resides in the server-side image fetching mechanism of the ImageSize class, which allows authenticated, staff-level users to force the backend to perform unvalidated HTTP GET requests targeting local or private network services. This report provides an in-depth exploration of the root cause, vulnerable code structures, patch implementations, and mitigation steps.\n\n## TL;DR\nServer-Side Request Forgery (SSRF) in Ghost CMS (versions < 6.54.1) allows authenticated staff-level users to execute arbitrary HTTP GET requests targeting local or private network services through the admin console's image processing module.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.1 (Medium)\n- **Exploit Status**: PoC / Authenticated\n- **Impact**: Internal Reconnaissance / SSRF\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost Content Management System (Node.js)\n- **Ghost**: >= 0.10.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost to version 6.54.1 or higher\n- Implement egress filtering to block outgoing traffic to private IP spaces and link-local ranges\n- Enforce IMDSv2 on AWS-hosted instances to protect metadata services from blind SSRF\n\n**Remediation Steps:**\n1. Identify current running Ghost instance version.\n2. Execute update commands through Ghost CLI: `ghost update 6.54.1`.\n3. Confirm the service is running the updated version: `ghost version`.\n4. Implement firewall egress rules (e.g., iptables) restricting the Ghost service user from connecting to localhost and private interfaces.\n\n## References\n\n- [GitHub Security Advisory GHSA-gcvv-72q8-9v76](https://github.com/TryGhost/Ghost/security/advisories/GHSA-gcvv-72q8-9v76)\n- [CVE-2026-70591 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-70591)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70591) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T04:31:14.944586Z"} https://vulnerability.circl.lu/sighting/0d27f17c-3814-46aa-9ef2-7f31fc14bdb6/export Wed, 05 Aug 2026 04:31:14 +0000 https://vulnerability.circl.lu/sighting/5b66855f-42aa-4b9f-85b2-7f8a03761179/export {"uuid": "5b66855f-42aa-4b9f-85b2-7f8a03761179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70592", "type": "seen", "source": "https://gist.github.com/alon710/7709dc60acce15f366b5c87665dcce14", "content": "# CVE-2026-70592: CVE-2026-70592: Path Traversal Vulnerability in Ghost CMS Database Exporter\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70592\n\n## Summary\nA path traversal vulnerability (CWE-22) in Ghost CMS versions 1.20.1 through 6.54.0 allows authenticated administrators to escape the backup directory and perform arbitrary file write operations on the hosting system. This vulnerability was resolved in version 6.54.1.\n\n## TL;DR\nAn authenticated path traversal vulnerability in Ghost CMS database export functionality allows arbitrary file writing on the server hosting the application, fixed in version 6.54.1.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.5\n- **EPSS Score**: N/A\n- **Impact**: Arbitrary File Write / Overwrite\n- **Exploit Status**: None / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 1.20.1, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.54.1 or later.\n- Set the environment variable disableJSBackups=true to disable the backup endpoint.\n- Implement strict least-privilege principles on the Ghost system service account.\n\n**Remediation Steps:**\n1. Check current Ghost version via command-line or administrative console.\n2. Upgrade the deployment to version 6.54.1 using the standard update command.\n3. Verify path traversal requests are blocked by testing against the updated API endpoint.\n4. Optionally modify config.production.json to set disableJSBackups to true if upgrading cannot occur immediately.\n\n## References\n\n- [GitHub Security Advisory GHSA-cj62-hvv2-2q5h](https://github.com/TryGhost/Ghost/security/advisories/GHSA-cj62-hvv2-2q5h)\n- [Official Fix Commit f466c30](https://github.com/TryGhost/Ghost/commit/f466c300191a609ed36c8d7c5d1e33ccd440786b)\n- [Ghost Release v6.54.1](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n- [NVD CVE-2026-70592 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-70592)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-70592)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70592) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T03:31:03.413096Z"} {"uuid": "5b66855f-42aa-4b9f-85b2-7f8a03761179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70592", "type": "seen", "source": "https://gist.github.com/alon710/7709dc60acce15f366b5c87665dcce14", "content": "# CVE-2026-70592: CVE-2026-70592: Path Traversal Vulnerability in Ghost CMS Database Exporter\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70592\n\n## Summary\nA path traversal vulnerability (CWE-22) in Ghost CMS versions 1.20.1 through 6.54.0 allows authenticated administrators to escape the backup directory and perform arbitrary file write operations on the hosting system. This vulnerability was resolved in version 6.54.1.\n\n## TL;DR\nAn authenticated path traversal vulnerability in Ghost CMS database export functionality allows arbitrary file writing on the server hosting the application, fixed in version 6.54.1.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.5\n- **EPSS Score**: N/A\n- **Impact**: Arbitrary File Write / Overwrite\n- **Exploit Status**: None / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 1.20.1, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.54.1 or later.\n- Set the environment variable disableJSBackups=true to disable the backup endpoint.\n- Implement strict least-privilege principles on the Ghost system service account.\n\n**Remediation Steps:**\n1. Check current Ghost version via command-line or administrative console.\n2. Upgrade the deployment to version 6.54.1 using the standard update command.\n3. Verify path traversal requests are blocked by testing against the updated API endpoint.\n4. Optionally modify config.production.json to set disableJSBackups to true if upgrading cannot occur immediately.\n\n## References\n\n- [GitHub Security Advisory GHSA-cj62-hvv2-2q5h](https://github.com/TryGhost/Ghost/security/advisories/GHSA-cj62-hvv2-2q5h)\n- [Official Fix Commit f466c30](https://github.com/TryGhost/Ghost/commit/f466c300191a609ed36c8d7c5d1e33ccd440786b)\n- [Ghost Release v6.54.1](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n- [NVD CVE-2026-70592 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-70592)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-70592)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70592) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T03:31:03.413096Z"} https://vulnerability.circl.lu/sighting/5b66855f-42aa-4b9f-85b2-7f8a03761179/export Wed, 05 Aug 2026 03:31:03 +0000 https://vulnerability.circl.lu/sighting/bf352174-7052-44ad-b2e9-4811ef5f5c9b/export {"uuid": "bf352174-7052-44ad-b2e9-4811ef5f5c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70593", "type": "seen", "source": "https://gist.github.com/alon710/8b519f2c594fb49b15bc37a85db39cf9", "content": "# CVE-2026-70593: CVE-2026-70593: Path Traversal and Arbitrary File Write via Custom Theme Upload in Ghost CMS\n\n> **CVSS Score:** 6.6\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70593\n\n## Summary\nCVE-2026-70593 is a path traversal and arbitrary file write vulnerability affecting Ghost CMS. Versions from 0.10.0 up to 6.54.0 are vulnerable. Authenticated administrators can exploit this flaw by uploading a custom theme in a ZIP archive that contains path traversal characters. The vulnerability is mitigated in version 6.54.1.\n\n## TL;DR\nA path traversal flaw in Ghost CMS theme extraction allows authenticated users with administrative privileges to write arbitrary files to the local file system using crafted ZIP archives.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 6.6 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: PoC available, no active in-the-wild exploitation observed\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS (Self-hosted instances)\n- **Ghost**: >= 0.10.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.54.1 or higher.\n- Enforce least-privilege system permissions for the Ghost server process.\n- Limit user permissions to restrict theme uploads to highly trusted administrators.\n\n**Remediation Steps:**\n1. Access the local hosting environment of your Ghost installation.\n2. Create a full backup of the system configuration, database, and content files.\n3. Run the upgrade command: 'ghost update' to patch the installation to 6.54.1 or higher.\n4. Verify that the active Ghost service processes run under a dedicated, unprivileged system user.\n\n## References\n\n- [GitHub Security Advisory GHSA-cjc9-q5gf-327p](https://github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p)\n- [CVE-2026-70593 Record](https://www.cve.org/CVERecord?id=CVE-2026-70593)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70593) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T02:31:21.552509Z"} {"uuid": "bf352174-7052-44ad-b2e9-4811ef5f5c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70593", "type": "seen", "source": "https://gist.github.com/alon710/8b519f2c594fb49b15bc37a85db39cf9", "content": "# CVE-2026-70593: CVE-2026-70593: Path Traversal and Arbitrary File Write via Custom Theme Upload in Ghost CMS\n\n> **CVSS Score:** 6.6\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70593\n\n## Summary\nCVE-2026-70593 is a path traversal and arbitrary file write vulnerability affecting Ghost CMS. Versions from 0.10.0 up to 6.54.0 are vulnerable. Authenticated administrators can exploit this flaw by uploading a custom theme in a ZIP archive that contains path traversal characters. The vulnerability is mitigated in version 6.54.1.\n\n## TL;DR\nA path traversal flaw in Ghost CMS theme extraction allows authenticated users with administrative privileges to write arbitrary files to the local file system using crafted ZIP archives.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 6.6 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: PoC available, no active in-the-wild exploitation observed\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS (Self-hosted instances)\n- **Ghost**: >= 0.10.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.54.1 or higher.\n- Enforce least-privilege system permissions for the Ghost server process.\n- Limit user permissions to restrict theme uploads to highly trusted administrators.\n\n**Remediation Steps:**\n1. Access the local hosting environment of your Ghost installation.\n2. Create a full backup of the system configuration, database, and content files.\n3. Run the upgrade command: 'ghost update' to patch the installation to 6.54.1 or higher.\n4. Verify that the active Ghost service processes run under a dedicated, unprivileged system user.\n\n## References\n\n- [GitHub Security Advisory GHSA-cjc9-q5gf-327p](https://github.com/TryGhost/Ghost/security/advisories/GHSA-cjc9-q5gf-327p)\n- [CVE-2026-70593 Record](https://www.cve.org/CVERecord?id=CVE-2026-70593)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70593) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T02:31:21.552509Z"} https://vulnerability.circl.lu/sighting/bf352174-7052-44ad-b2e9-4811ef5f5c9b/export Wed, 05 Aug 2026 02:31:21 +0000 https://vulnerability.circl.lu/sighting/3b47f3e3-5302-42e1-ba00-835b38e9fd53/export {"uuid": "3b47f3e3-5302-42e1-ba00-835b38e9fd53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70594", "type": "seen", "source": "https://gist.github.com/alon710/a8f899d9b938031c01419f5cf3be4d0e", "content": "# CVE-2026-70594: CVE-2026-70594: Session Fixation in Ghost Admin Panel\n\n> **CVSS Score:** 6.7\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70594\n\n## Summary\nA critical session fixation vulnerability exists in the Ghost Admin panel from version 2.2.0 until 6.54.1. The Express-based authentication backend fails to invalidate or rotate the session identifier during login, allowing attackers to hijack administrative sessions.\n\n## TL;DR\nGhost Admin did not rotate session identifiers upon login. This allowed session fixation attacks, enabling attackers with subdomain or domain-level cookie injection capabilities to hijack administrative sessions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-384\n- **Attack Vector**: Adjacent Network\n- **Attack Complexity**: High\n- **CVSS Score**: 6.7 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost Content Management System (CMS)\n- Ghost Admin Panel\n- **Ghost**: >= 2.2.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost to version 6.54.1 or newer\n- Enforce strict cookie domain and host isolation\n- Enable HttpOnly, Secure, and SameSite cookie policies\n\n**Remediation Steps:**\n1. Verify the current Ghost version using the command line\n2. Execute the `ghost update` command to install version 6.54.1 or higher\n3. Revoke all active sessions in the backend storage to invalidate existing un-regenerated session cookies\n\n## References\n\n- [Ghost Session Fixation Patch Commit](https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c)\n- [Ghost Security PR 29634](https://github.com/TryGhost/Ghost/pull/29634)\n- [GitHub Security Advisory GHSA-7mpp-r37j-x5wh](https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh)\n- [Ghost v6.54.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n- [CVE-2026-70594 Record](https://www.cve.org/CVERecord?id=CVE-2026-70594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70594) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T01:31:27.427528Z"} {"uuid": "3b47f3e3-5302-42e1-ba00-835b38e9fd53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70594", "type": "seen", "source": "https://gist.github.com/alon710/a8f899d9b938031c01419f5cf3be4d0e", "content": "# CVE-2026-70594: CVE-2026-70594: Session Fixation in Ghost Admin Panel\n\n> **CVSS Score:** 6.7\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70594\n\n## Summary\nA critical session fixation vulnerability exists in the Ghost Admin panel from version 2.2.0 until 6.54.1. The Express-based authentication backend fails to invalidate or rotate the session identifier during login, allowing attackers to hijack administrative sessions.\n\n## TL;DR\nGhost Admin did not rotate session identifiers upon login. This allowed session fixation attacks, enabling attackers with subdomain or domain-level cookie injection capabilities to hijack administrative sessions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-384\n- **Attack Vector**: Adjacent Network\n- **Attack Complexity**: High\n- **CVSS Score**: 6.7 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost Content Management System (CMS)\n- Ghost Admin Panel\n- **Ghost**: >= 2.2.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost to version 6.54.1 or newer\n- Enforce strict cookie domain and host isolation\n- Enable HttpOnly, Secure, and SameSite cookie policies\n\n**Remediation Steps:**\n1. Verify the current Ghost version using the command line\n2. Execute the `ghost update` command to install version 6.54.1 or higher\n3. Revoke all active sessions in the backend storage to invalidate existing un-regenerated session cookies\n\n## References\n\n- [Ghost Session Fixation Patch Commit](https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c)\n- [Ghost Security PR 29634](https://github.com/TryGhost/Ghost/pull/29634)\n- [GitHub Security Advisory GHSA-7mpp-r37j-x5wh](https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh)\n- [Ghost v6.54.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n- [CVE-2026-70594 Record](https://www.cve.org/CVERecord?id=CVE-2026-70594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70594) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T01:31:27.427528Z"} https://vulnerability.circl.lu/sighting/3b47f3e3-5302-42e1-ba00-835b38e9fd53/export Wed, 05 Aug 2026 01:31:27 +0000 https://vulnerability.circl.lu/sighting/c33d4df6-041d-438f-9c96-e7a58a278b8c/export {"uuid": "c33d4df6-041d-438f-9c96-e7a58a278b8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70594", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6f6e3y6mttsbe", "content": "CVE-2026-70594 - Ghost: Session Fixation in Ghost Admin\nCVE ID : CVE-2026-70594\n \n Published : Aug. 4, 2026, 9:53 p.m. | 22\u00a0minutes ago\n \n Description : Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on l...", "creation_timestamp": "2026-08-04T22:36:37.367181Z"} {"uuid": "c33d4df6-041d-438f-9c96-e7a58a278b8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70594", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6f6e3y6mttsbe", "content": "CVE-2026-70594 - Ghost: Session Fixation in Ghost Admin\nCVE ID : CVE-2026-70594\n \n Published : Aug. 4, 2026, 9:53 p.m. | 22\u00a0minutes ago\n \n Description : Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on l...", "creation_timestamp": "2026-08-04T22:36:37.367181Z"} https://vulnerability.circl.lu/sighting/c33d4df6-041d-438f-9c96-e7a58a278b8c/export Tue, 04 Aug 2026 22:36:37 +0000 https://vulnerability.circl.lu/sighting/0c2fbce8-5810-443c-9225-928b146db81d/export {"uuid": "0c2fbce8-5810-443c-9225-928b146db81d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70593", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iw3rld4msreml", "content": "CVE-2026-70593 - Ghost: Theme Upload Path Traversal\nCVE ID : CVE-2026-70593\n \n Published : Aug. 4, 2026, 9:49 p.m. | 26\u00a0minutes ago\n \n Description : Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to...", "creation_timestamp": "2026-08-04T22:30:37.463522Z"} {"uuid": "0c2fbce8-5810-443c-9225-928b146db81d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70593", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iw3rld4msreml", "content": "CVE-2026-70593 - Ghost: Theme Upload Path Traversal\nCVE ID : CVE-2026-70593\n \n Published : Aug. 4, 2026, 9:49 p.m. | 26\u00a0minutes ago\n \n Description : Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to...", "creation_timestamp": "2026-08-04T22:30:37.463522Z"} https://vulnerability.circl.lu/sighting/0c2fbce8-5810-443c-9225-928b146db81d/export Tue, 04 Aug 2026 22:30:37 +0000