9.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26980

CVE-2026-26980: Ghost has a SQL Injection in its Content API

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26980

CVE-2026-26980:

9.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ghost	npm	>= 3.24.0, < 6.19.1	6.19.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic SQL injection found in Ghost's Content API. The root cause lies in the slugFilterOrder function, which is responsible for generating a SQL ORDER BY clause based on a list of slugs provided in the filter query parameter. The provided patch commit, 30868d632b2252b638bc8a4c8ebf73964592ed91, clearly shows the vulnerable code and the subsequent fix.

In the vulnerable version, the slugFilterOrder function iterated through the slugs provided by the user and directly embedded them into the SQL string using template literals: order += \WHEN `${table}`.`slug` = '${slug}' THEN ${index} `;`. This direct concatenation without proper sanitization allowed for the injection of arbitrary SQL commands.

The fix involves refactoring the function to use parameterized queries. Instead of embedding the user input directly, the new code generates a SQL string with ? placeholders and passes the user-provided slugs as separate bindings. This ensures that the database treats the slug values strictly as data and not as executable SQL, thereby preventing the injection vulnerability. The changes in ghost/core/core/server/models/base/plugins/crud.js support this by allowing the model layer to accept and process these bindings along with the raw SQL.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.