CVE-2026-70595 — MEDIUM (4.0)

Vulnerability Description

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.

CVSS Score

4.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-918

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-x5mm-wm4g-j5xv

FAQ

What is CVE-2026-70595?

CVE-2026-70595 is a vulnerability with a CVSS score of 4.0 (MEDIUM). Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP...

How severe is CVE-2026-70595?

CVE-2026-70595 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-70595?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.