CVE-2026-70591: 
JavaScript vulnerability analysis and mitigation

CVE-2026-70591 is a Server-Side Request Forgery (SSRF) vulnerability in the Ghost Node.js content management system, specifically in the Ghost Admin image fetching functionality. It affects Ghost versions from 0.10.0 up to (but not including) 6.54.1, and was disclosed on July 30, 2026, with the GitHub Advisory Database entry published on August 4, 2026. Any authenticated staff-level user can exploit this flaw to perform blind HTTP GET requests against internal hosts, enabling internal network port probing. It carries a CVSS v3.1 base score of 4.1 (Medium) (Github Advisory, Ghost Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where the Ghost Admin image fetching code used an insufficiently protected HTTP client (got) that did not enforce consistent URL host validation across all image types. Specifically, the image-size.js module used a raw request function without routing through Ghost's SSRF-protected externalRequest client, allowing arbitrary internal URLs to be fetched. The fix (commit 5eff2de) replaced the unprotected request dependency with a fetchExternal function that routes all image fetch requests through the externalRequest.get SSRF-protected got client, ensuring uniform host validation (Ghost Advisory, Fix Commit). Exploitation requires a valid staff-level account (high privileges), and no response output is returned to the attacker, making this a blind SSRF.

A successful exploit allows a staff-level Ghost Admin user to send blind HTTP GET requests to arbitrary internal hosts, effectively enabling reconnaissance of the internal network topology and open port discovery. No response data is returned to the attacker, limiting direct data exfiltration, but the vulnerability could be used to map internal services, identify vulnerable internal endpoints, or facilitate further attacks against internal infrastructure. Integrity and availability are not directly impacted; the confidentiality impact is limited to low-level information leakage about internal host/port availability (Github Advisory).

There is no public evidence of active in-the-wild exploitation, and the NVD SSVC assessment indicates exploitation status as "none" (Github Advisory). No exploit code or proof-of-concept has been publicly released as of the time of this report. The EPSS score is approximately 0.226% (13th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated staff-level access to Ghost Admin, which significantly limits the attacker pool.

1. Obtain Staff-Level Access: Acquire valid Ghost Admin credentials for a staff-level (or higher) account, either through phishing, credential stuffing, or insider access.
2. Identify the Image Fetch Endpoint: Navigate to Ghost Admin and locate functionality that triggers server-side image fetching, such as inserting an image by URL in the post editor or using the image upload feature that accepts external URLs.
3. Craft a Malicious URL: Supply an internal host URL (e.g., http://169.254.169.254/, http://10.0.0.1:8080/, or http://localhost:22/) as the image source to be fetched by the Ghost server.
4. Trigger the SSRF Request: Submit the crafted image URL through the Ghost Admin interface, causing the server to issue a blind HTTP GET request to the specified internal host and port.
5. Infer Internal Network State: Observe timing differences or error responses in the Ghost Admin UI to infer whether the targeted internal host/port is open or closed, enabling port scanning of internal infrastructure (Ghost Advisory, Fix Commit).

• Network: Outbound HTTP GET requests from the Ghost server process to internal RFC-1918 addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), or cloud metadata endpoints (e.g., 169.254.169.254); unusual connection attempts to non-standard internal ports originating from the Ghost Node.js process.
• Logs: Ghost application logs showing image fetch requests to internal or non-routable IP addresses; HTTP client errors or timeouts in Ghost logs referencing internal hostnames or IPs.
• Process: The Ghost Node.js process initiating outbound TCP connections to internal hosts on ports not associated with normal CMS operation (e.g., ports 22, 3306, 6379, 8080).

The primary remediation is to upgrade Ghost to version 6.54.1 or later, which contains the fix routing all image fetch requests through the SSRF-protected externalRequest client (Ghost Advisory, Ghost Release). Docker-based deployments should update to the latest official Ghost Docker image, and Ghost-CLI installs should follow the standard update procedure documented by Ghost. As a network-level workaround, restrict outbound HTTP connections from the Ghost server to only necessary external hosts using firewall rules or egress filtering, which would limit the effectiveness of SSRF-based internal probing. No configuration-only workaround within Ghost itself is available; upgrading is the recommended and only complete fix.

The vulnerability was responsibly disclosed by researchers Younghun Ko (koyokr), vx77, and Miguel Segovia Gil, and Ghost acknowledged their contributions in the official advisory (Ghost Advisory). The advisory was published with moderate severity, and no significant broader media coverage or notable community controversy has been observed. The fix was straightforward — replacing an unprotected HTTP client with a SSRF-hardened equivalent — and the limited impact (blind SSRF, high privilege required) has kept community reaction subdued.