Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-70591 Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to pe… https://www.cve.org/CVERecord?id=CVE-2026-70591
Post summary
A new CVE (CVE-2026-70591) identifies a Server‑Side Request Forgery vulnerability in Ghost CMS versions 0.10.0 to 6.54.1 that can be leveraged by staff‑level users.
🚨*CVE* CVE-2026-70591 Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to pe… https://www.cve.org/CVERecord?id=CVE-2026-70591 ----- Traducción: CVE-2026-70591 Gho… http://infoflow.cloud`
Post summary
The post announces CVE-2026-70591, describing a Server‑Side Request Forgery in Ghost’s admin image fetching that can be abused by staff‑level users, but no PoC, exploit, or patch details are provided.