2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22597

CVE-2026-22597: Ghost has SSRF via External Media Inliner

Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22597

CVE-2026-22597:

2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ghost	npm	>= 6.0.0, <= 6.10.3	6.11.0
ghost	npm	>= 5.105.0, <= 5.130.5	5.130.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-vmc4-9828-r48r, is an SSRF flaw in Ghost's external media inlining feature. The provided patches (15d49131ff4aac3aca8642501c793f01f2bfcbb9 and 93add549ccf079d8e28bdb724fbb71a76942ff51) clearly show the mitigation. The core change is in ghost/core/core/server/services/media-inliner/ExternalMediaInliner.js, where the underlying HTTP request library is swapped from @tryghost/request to a more restrictive internal library, request-external. The commit message explicitly states this is to block requests to internal IP blocks. Furthermore, the added unit test targets the getRemoteMedia method within the ExternalMediaInliner class, simulating a DNS lookup that resolves to a private IP and asserting that the request is blocked. This pinpoints ExternalMediaInliner.getRemoteMedia as the function that performs the outbound request and was therefore the source of the SSRF vulnerability. During exploitation, a call to this function with a malicious URL would appear in a runtime profile.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.