Skip to content
OpenAdvisories

Package · npm

ghost

62 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-104415

    Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

    Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer…

    TryGhost Ghost ghost npm
  • Low 3.8
    CVE-2026-103290

    Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize

    Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended da…

    TryGhost Ghost ghost npm
  • Low 2.7
    CVE-2026-103287

    Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook

    Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources fr…

    TryGhost Ghost ghost npm