{"vulnerability": "CVE-2026-29053", "sightings": [{"uuid": "be3335db-f945-4d7a-8a4b-39b2da38f534", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgc5t5stv72h", "content": "", "creation_timestamp": "2026-03-05T06:21:27.458687Z"}, {"uuid": "771be8d9-2733-4106-ab33-c878c278bb73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mib6yut7xf23", "content": "", "creation_timestamp": "2026-03-30T08:00:15.901296Z"}, {"uuid": "d7e9d7ce-09af-4eff-8e19-e3c0406ce80c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/81221", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-29053\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AC8999\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a CSS\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-21 23:57:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n(RCE) vulnerability discovered in Ghost CMS (specifically affecting versions 0.7.2 through 6.19.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-22T00:00:04.000000Z"}, {"uuid": "33b8bfaf-5633-47b4-a704-ad34ce0ec0e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "published-proof-of-concept", "source": "Telegram/4bKDS933-0b55qM7WdBrOYyTgLQnD9_rI0Z1t-1c37mSxrw", "content": "", "creation_timestamp": "2026-04-22T03:00:07.000000Z"}, {"uuid": "f4d6e975-4717-4bbf-a423-647e0f44f05e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Maksim Rogov\", \"Cristian-Alexandru Staicu\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.\\n          Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.\\n\\n          The affected versions include all releases from 0.7.2 up to and including 6.19.0.\\n          For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass.\", \"disclosure_date\": \"2026-03-02\", \"fullname\": \"exploit/multi/http/ghostcms_auth_rce_cve_2026_29053\", \"is_install_path\": true, \"mod_time\": \"2026-08-07 05:21:48 +0000\", \"name\": \"Ghost CMS Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/ghostcms_auth_rce_cve_2026_29053\", \"references\": [\"CVE-2026-29053\", \"CVE-2026-22594\", \"URL-https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Ghost >= 0.7.2, <= 6.19.0 / Unix payload\", \"Ghost >= 0.7.2, <= 6.19.0 / Windows payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-10T10:02:09.462793Z"}, {"uuid": "02de3ea9-7b66-4a52-a40a-f28be1cdca51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29053", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Maksim Rogov\", \"Cristian-Alexandru Staicu\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.\\n          Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.\\n\\n          The affected versions include all releases from 0.7.2 up to and including 6.19.0.\\n          For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass.\", \"disclosure_date\": \"2026-03-02\", \"fullname\": \"exploit/multi/http/ghostcms_auth_rce_cve_2026_29053\", \"is_install_path\": true, \"mod_time\": \"2026-08-20 14:26:49 +0000\", \"name\": \"Ghost CMS Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/ghostcms_auth_rce_cve_2026_29053\", \"references\": [\"CVE-2026-29053\", \"CVE-2026-22594\", \"URL-https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Ghost >= 0.7.2, <= 6.19.0 / Unix payload\", \"Ghost >= 0.7.2, <= 6.19.0 / Windows payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:47.960772Z"}]}