{"vulnerability": "CVE-2026-5394", "sightings": [{"uuid": "d7e5ca57-69b0-4de5-95e3-a008a80da26a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53947", "type": "seen", "source": "https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a", "content": "# CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53947\n\n## Summary\nCVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.\n\n## TL;DR\nGhost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.\n\n## Technical Details\n\n- **CWE ID**: CWE-204 (Observable Response Discrepancy)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00206 (Percentile: 10.84%)\n- **Impact**: User Enumeration\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.18.0, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Apply rate limiting on the `/members/api/send-magic-link` endpoint.\n- Implement WAF monitoring rules.\n\n**Remediation Steps:**\n1. Verify current Ghost version running in production.\n2. Update Ghost dependency to version 6.21.1 or newer.\n3. Redeploy the application and verify portal authentication functions.\n4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.\n5. Monitor log traffic to detect outstanding scanning signatures.\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42)\n- [Official Fix Commit](https://github.com/TryGhost/Ghost/commit/fb2bb634653d99de68fc42d415721d755284fe30)\n- [Pull Request](https://github.com/TryGhost/Ghost/pull/26752)\n- [Official Release](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53947)\n- [NVD Vuln Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53947)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53947) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T23:31:07.952240Z"}, {"uuid": "8212c67a-63ad-45ce-bad5-861f33c2268c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53947", "type": "seen", "source": "https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a", "content": "# CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53947\n\n## Summary\nCVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.\n\n## TL;DR\nGhost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.\n\n## Technical Details\n\n- **CWE ID**: CWE-204 (Observable Response Discrepancy)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00206 (Percentile: 10.84%)\n- **Impact**: User Enumeration\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.18.0, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Apply rate limiting on the `/members/api/send-magic-link` endpoint.\n- Implement WAF monitoring rules.\n\n**Remediation Steps:**\n1. Verify current Ghost version running in production.\n2. Update Ghost dependency to version 6.21.1 or newer.\n3. Redeploy the application and verify portal authentication functions.\n4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.\n5. Monitor log traffic to detect outstanding scanning signatures.\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42)\n- [Official Fix Commit](https://github.com/TryGhost/Ghost/commit/fb2bb634653d99de68fc42d415721d755284fe30)\n- [Pull Request](https://github.com/TryGhost/Ghost/pull/26752)\n- [Official Release](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53947)\n- [NVD Vuln Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53947)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53947) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T00:00:39.625475Z"}, {"uuid": "9bf22817-f9f3-430b-9293-0d987dc1ccaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53946", "type": "seen", "source": "https://gist.github.com/alon710/12c62bdb45c24ef118204a5bc7818a85", "content": "# CVE-2026-53946: CVE-2026-53946: Server-Side Request Forgery in Ghost CMS Mobiledoc Processing Workflow\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53946\n\n## Summary\nA Server-Side Request Forgery (SSRF) vulnerability exists in the Mobiledoc post-rendering component of Ghost CMS versions 6.19.4 through 6.21.0. This allows authenticated staff users with post creation or editing privileges to force the application server to perform arbitrary outbound HTTP GET requests, targeting internal endpoints, local loopback interfaces, or cloud metadata endpoints.\n\n## TL;DR\nMedium-severity SSRF in Ghost CMS (v6.19.4 - v6.21.0) allows authenticated authors/editors to abuse image dimension parsing to probe internal services and access cloud metadata servers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00122 (~2.31% probability of exploitation)\n- **Impact**: Unauthorized retrieval of internal server and metadata resources\n- **Exploit Status**: Proof-of-Concept / Code-level analysis\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 6.19.4, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or above\n- Implement outbound firewall rules to prevent Ghost from contacting private subnets (RFC 1918) and cloud instance metadata services (169.254.169.254)\n\n**Remediation Steps:**\n1. Verify the current running version of Ghost CMS in your administration dashboard or command-line interface.\n2. Upgrade the application by running the upgrade sequence using the Ghost CLI utility: `ghost update`.\n3. Review network security group rules on your cloud virtual machine to isolate outbound communication from the application instance.\n4. Audit active user profiles within your Ghost settings and downgrade permissions for any untrusted or obsolete staff accounts.\n\n## References\n\n- [CVE.org Record Page](https://www.cve.org/CVERecord?id=CVE-2026-53946)\n- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2026-53946)\n- [GitHub Advisory Database Record](https://github.com/TryGhost/Ghost/security/advisories/GHSA-g366-23fw-ggp6)\n- [Ghost v6.21.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53946) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T06:32:52.198611Z"}, {"uuid": "d71e2672-a622-4efa-9b48-a2c278367e38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53945", "type": "seen", "source": "https://gist.github.com/alon710/e46f39ae43e3fffa5ce1183a133d472c", "content": "# CVE-2026-53945: CVE-2026-53945: Time-of-Check to Time-of-Use (TOCTOU) DNS Rebinding Server-Side Request Forgery in Ghost CMS\n\n> **CVSS Score:** 4.0\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53945\n\n## Summary\nGhost CMS is vulnerable to Server-Side Request Forgery (SSRF) in versions 6.0.9 through 6.21.1. Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition in its outbound fetch validation logic, an attacker can bypass IP blocklists via DNS Rebinding. This allows unauthorized interaction with private networks and local services.\n\n## TL;DR\nA DNS Rebinding vulnerability in Ghost CMS allows attackers to bypass private IP blocklists and execute SSRF requests against local networks due to a TOCTOU race condition between request validation and socket establishment.\n\n## Technical Details\n\n- **CWE ID**: CWE-367 (TOCTOU), CWE-918 (SSRF)\n- **Attack Vector**: Network (Unauthenticated SSRF)\n- **CVSS Score**: 4.0 (Medium)\n- **EPSS Score**: 0.00140 (0.14%)\n- **Exploit Status**: Proof of Concept / Technical Analysis available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS self-hosted deployments running versions 6.0.9 through 6.21.0\n- **Ghost**: >= 6.0.9, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Implement network egress filters using iptables or cloud security groups to restrict outbound connections to private subnets.\n- Ensure production deployments have NODE_ENV set to production.\n\n**Remediation Steps:**\n1. Navigate to the Ghost installation directory on your host server.\n2. Execute 'ghost update' to pull and install the latest security releases.\n3. Verify the running configuration environment by inspecting the startup logs for active development mode warnings.\n4. Configure cloud security rules to block outgoing traffic from the Ghost server targeting the metadata address 169.254.169.254.\n\n## References\n\n- [GitHub Security Advisory GHSA-ch52-px8q-f22j](https://github.com/TryGhost/Ghost/security/advisories/GHSA-ch52-px8q-f22j)\n- [NVD - CVE-2026-53945 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-53945)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53945) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T07:31:31.621676Z"}, {"uuid": "786ce985-725c-4cbb-811a-bce710846941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5394", "type": "published-proof-of-concept", "source": "https://github.com/pimcore/pimcore/security/advisories/GHSA-r2f4-ff2p-xc64", "content": "", "creation_timestamp": "2026-05-26T14:10:25.000000Z"}, {"uuid": "7a059bcf-0eae-4fb5-aacd-52fd03a0ccb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53944", "type": "seen", "source": "https://gist.github.com/alon710/489e9ca002ac3cb955fb509b828c43ec", "content": "# CVE-2026-53944: CVE-2026-53944: Server-Side Request Forgery Private IP Filtering Bypass in Ghost CMS\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53944\n\n## Summary\nA Server-Side Request Forgery (SSRF) vulnerability exists in the Ghost content management system from version 6.0.9 up to, but not including, 6.21.1. The flaw resides in the 'request-external.js' module, where the IP address validation blocklist fails to account for fully expanded IPv4-mapped IPv6 formats. This allows unauthenticated remote attackers to bypass the private IP filter and initiate unauthorized connections to loopback services, internal subnets, or cloud instance metadata endpoints.\n\n## TL;DR\nGhost CMS versions 6.0.9 through 6.21.0 fail to validate expanded IPv4-mapped IPv6 addresses, enabling remote attackers to bypass SSRF protections and access internal network resources or cloud metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 5.8\n- **EPSS Score**: 0.00197\n- **Impact**: Bypass of network sanitization boundary to target local/private endpoints\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS installations running version 6.0.9 up to 6.21.0\n- **Ghost**: >= 6.0.9, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost instances to version 6.21.1 or later to apply the official patch.\n- Configure host-based firewall rules (iptables/nftables) to drop outbound traffic from the Ghost process to private subnets and local loopback.\n- Deploy WAF rules to detect and block incoming request payloads that contain expanded IPv4-mapped IPv6 addresses.\n\n**Remediation Steps:**\n1. For standard Ghost CLI installations, run 'ghost update' to update to the latest patched version.\n2. For Docker-based deployments, pull the latest image tag using 'docker pull ghost:6.21.1' or update the docker-compose configuration.\n3. In AWS or other cloud environments, enforce IMDSv2 with a hop limit of 1 to prevent metadata access via container SSRF.\n\n## References\n\n- [GitHub Security Advisory GHSA-wvp2-4qqp-4h3r](https://github.com/TryGhost/Ghost/security/advisories/GHSA-wvp2-4qqp-4h3r)\n- [Ghost Version 6.21.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [NVD Record for CVE-2026-53944](https://nvd.nist.gov/vuln/detail/CVE-2026-53944)\n- [CVE.org Record for CVE-2026-53944](https://www.cve.org/CVERecord?id=CVE-2026-53944)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53944) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T08:32:27.981516Z"}, {"uuid": "21483bc1-2188-444d-8d7a-28e8bc4e3923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53948", "type": "seen", "source": "https://gist.github.com/alon710/f15b7efa1dfc268f551e391b3e8839f1", "content": "# CVE-2026-53948: CVE-2026-53948: Stored Cross-Site Scripting via File Upload Content-Type Spoofing in Ghost\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53948\n\n## Summary\nCVE-2026-53948 is a stored cross-site scripting (XSS) vulnerability in the Ghost content management system. Affected versions (v6.19.4 up to v6.21.0) trusted the client-supplied Content-Type header during file uploads via the Admin API. This allowed authenticated attackers to upload benignly-named files with executable MIME types (like text/html), executing scripts in visitor browsers when hosted on integrated cloud platforms like S3 or GCS.\n\n## TL;DR\nGhost versions 6.19.4 to 6.21.0 are vulnerable to Stored Cross-Site Scripting because they trust client-provided file MIME types during upload. Authenticated users can spoof content types to serve HTML scripts from cloud backends, compromising visitors and administrators. This issue is resolved in version 6.21.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-434\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.4 (Medium)\n- **Exploit Status**: PoC Concept available\n- **CISA KEV Status**: Not listed\n- **Impact**: Stored Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 6.19.4, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost to v6.21.1 or later\n- Enable 'X-Content-Type-Options: nosniff' header on web proxy\n- Configure storage buckets to serve assets from a sandboxed domain\n\n**Remediation Steps:**\n1. Identify active Ghost version running on host\n2. Execute upgrade to 6.21.1 using 'ghost update' command\n3. Verify that files are served with headers corresponding strictly to their extension mapped server-side\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-944x-pm95-3jpr)\n- [GitHub Fix Commit](https://github.com/TryGhost/Ghost/commit/d659e752d6636144d75b9aa94062cdbc88a16b21)\n- [GitHub Pull Request](https://github.com/TryGhost/Ghost/pull/26751)\n- [v6.21.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-53948)\n- [CVE Org Entry](https://www.cve.org/CVERecord?id=CVE-2026-53948)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53948) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T10:31:29.945302Z"}, {"uuid": "e13b15e4-0ee1-4cc4-aafa-a8856562a467", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53943", "type": "seen", "source": "https://bsky.app/profile/cryptocat.me/post/3mo3hfsyulk2h", "content": "Here's the writeup for CVE-2026-53943, a cache poisoning -> XSS vuln I found in Ghost CMS \ud83d\udc7b\n\ncryptocat.me/blog/researc...", "creation_timestamp": "2026-06-12T09:45:53.509099Z"}, {"uuid": "48a0ddf6-ca50-4ea8-badc-01d1dce698e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53943", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpoxjfntry2g", "content": "CVE-2026-53943 - ghost\nGhost, a popular content management system, has a security flaw that affects its caching feature. If not fixed, an attacker could manipulate content seen by other users, potentially taking\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ghost #npm #CVE #infosec", "creation_timestamp": "2026-07-02T21:19:58.444839Z"}]}