Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.0

Ghost can let attackers reach internal network resources

CVE-2025-9862 · published 1 year ago
Summary

The Ghost publishing platform (versions 5.99.0 through 5.130.3 and 6.0.0 through 6.0.8) can be tricked into contacting internal systems on your network. An attacker could use this to view or interact with services that should not be publicly accessible. Update Ghost to the latest version or apply the vendor's security patch to stop this behavior.

What to do
  • Update ghost-slimer ghost to version 6.0.9.
  • Update ghost-slimer ghost to version 5.130.4.
Affected software
Ecosystem VendorProductAffected versions
npm ghost-slimer ghost >= 6.0.0, <= 6.0.8
>= 5.99.0, <= 5.130.3
Fix: upgrade to 6.0.9
– ghost ghost >= 5.99.0, <= 5.130.3
>= 6.0.0, <= 6.0.8
cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*
Original advisory text
Ghost 6.0.6 - SSRF via oEmbed Bookmark
Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.0 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published17 Sep 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-f7qg-xj45-w956 · GHSA
CVE-2025-9862 · NVD
CVE-2025-9862 · OSV
Track software like this
Free during beta