Medium · 6.1 CVE-2025-9862 BIT-ghost-2025-9862EUVD-2025-29242GHSA-f7qg-xj45-w956

Ghost 6.0.6 - SSRF via oEmbed Bookmark

Published Sep 17, 2025 · Updated Sep 17, 2025 · Assigned by Fluid Attacks

Vendor: Ghost Foundation Product: Ghost Package: ghost Ecosystem: npm

Description

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

Affected products

Vendor	Product	Affected	Fixed
Ghost	Ghost	6.0.0 – ≤ 6.0.8, 5.99.0 – ≤ 5.130.3	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	ghost	>= 6.0.0, < 6.0.9	6.0.9	GHSA-f7qg-xj45-w956
npm	ghost	>= 5.99.0, < 5.130.4	5.130.4	GHSA-f7qg-xj45-w956

References

https://fluidattacks.com/advisories/regida third-party-advisory
https://github.com/TryGhost/Ghost product
https://github.com/TryGhost/Ghost/releases/tag/v6.0.9 patch
https://github.com/TryGhost/Ghost/security/advisories/GHSA-f7qg-xj45-w956 vendor-advisory