CVE-2026-22597 Security Details

CVE ID

CVE-2026-22597

CWE

CWE-918

CVE Description

Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.

Published

Jan 9, 2026

CVSS Score & Severity

2.7Low

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS Score

0.058%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Affected Ecosystems

affected

Source

National Vulnerability Database

References

https://github.com/advisories/GHSA-vmc4-9828-r48rTHIRD_PARTY