CVE-2026-53946: Server-Side Request Forgery in Ghost CMS Mobiledoc Processing Workflow

Vulnerability ID: CVE-2026-53946
CVSS Score: 5.4
Published: 2026-08-04

A Server-Side Request Forgery (SSRF) vulnerability exists in the Mobiledoc post-rendering component of Ghost CMS versions 6.19.4 through 6.21.0. This allows authenticated staff users with post creation or editing privileges to force the application server to perform arbitrary outbound HTTP GET requests, targeting internal endpoints, local loopback interfaces, or cloud metadata endpoints.

TL;DR

Medium-severity SSRF in Ghost CMS (v6.19.4 - v6.21.0) allows authenticated authors/editors to abuse image dimension parsing to probe internal services and access cloud metadata servers.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-918 (Server-Side Request Forgery)
• Attack Vector: Network (AV:N)
• CVSS Severity Score: 5.4 (Medium)
• EPSS Score: 0.00122 (~2.31% probability of exploitation)
• Impact: Unauthorized retrieval of internal server and metadata resources
• Exploit Status: Proof-of-Concept / Code-level analysis
• KEV Status: Not listed

Affected Systems

• Ghost CMS
• Ghost: >= 6.19.4, < 6.21.1 (Fixed in: 6.21.1)

Code Analysis

Commit: ba692df

Fix credential leak vulnerability (ONC-1525) by enforcing domain restrictions in mobiledoc image parsing

@@ -140,7 +140,7 @@ module.exports = {
                     size = await getUnsplashSize(payload.src);
                 } else if (isRelativeImagePath || storageUtils.isLocalImage(payload.src)) {
                     size = await imageSize.getOriginalImageSizeFromStorageUrl(payload.src);
-                } else {
+                } else if (storageUtils.isInternalImage(payload.src)) {
                     size = await imageSize.getImageSizeFromUrl(payload.src);
                 }

Mitigation Strategies

• Upgrade Ghost CMS to version 6.21.1 or above
• Implement outbound firewall rules to prevent Ghost from contacting private subnets (RFC 1918) and cloud instance metadata services (169.254.169.254)

Remediation Steps:

1. Verify the current running version of Ghost CMS in your administration dashboard or command-line interface.
2. Upgrade the application by running the upgrade sequence using the Ghost CLI utility: ghost update.
3. Review network security group rules on your cloud virtual machine to isolate outbound communication from the application instance.
4. Audit active user profiles within your Ghost settings and downgrade permissions for any untrusted or obsolete staff accounts.

References

• CVE.org Record Page
• NVD CVE Details
• GitHub Advisory Database Record
• Ghost v6.21.1 Release Notes

Read the full report for CVE-2026-53946 on our website for more details including interactive diagrams and full exploit analysis.