Ghost
v6.77.0Independent technology for modern publishing, memberships, subscriptions and newsletters.
- Maintenance
- Active2463 commits in 3 months · bus factor 6
- License
- MITPermissive · OSI-approved
- Security
- 30 advisories12 high, 16 medium, 2 low · Scorecard 5.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
55.8k stars · 12.1k forks · 240 open issues · last release 3 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 12 high, 16 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-8jqq-qq46-c657Nov 13, 2026Owner Role Assignment via Content Import
- Affected
- >= 1.0.0, < 6.76.0
- Patched in
- 6.76.0
- mediumGHSA-m978-hrwp-8xg5Nov 13, 2026Member Email Enumeration via Stripe Checkout
- Affected
- >= 6.62.0 <= 6.71.0
- Patched in
- 6.72.0
- lowGHSA-p6x5-mfv9-84qxNov 13, 2026Imported Media Fetched Over Plaintext HTTP for Protocol-Relative URLs
- Affected
- >= 5.70.0, < 6.76.0
- Patched in
- 6.76.0
- mediumGHSA-9wp5-gvxp-8wv6Nov 13, 2026Denial of Service via Crafted Revue Import
- Affected
- >= 5.26.0, < 6.76.0
- Patched in
- 6.76.0
- mediumGHSA-9c5c-w94h-xp32Nov 13, 2026Disclosure of Deleted and Hidden Comment Content via Members Comments API Filters
- Affected
- >= 5.9.0, < 6.76.0
- Patched in
- 6.76.0
- mediumGHSA-86pw-gh6f-cpmgNov 13, 2026Media Thumbnail Overwrite by Contributors
- Affected
- >= 4.22.2, < 6.76.0
- Patched in
- 6.76.0
- mediumGHSA-vh3j-4gg7-7vjwNov 13, 2026Revenue Data Exposed to Staff Users via Stats Endpoints
- Affected
- >= 5.77.0, < 6.76.0
- Patched in
- 6.76.0
- mediumGHSA-299g-j426-ff48Nov 13, 2026Denial of Service via Async Helper ID in Theme Data
- Affected
- < 6.77.0
- Patched in
- 6.77.0
- mediumGHSA-q58f-57cg-xfw5Nov 13, 2026Private Site Access Code Brute Force via Forged Session Cookies
- Affected
- < 6.77.0
- Patched in
- 6.77.0
- mediumGHSA-994c-84qf-j7q9Nov 13, 2026Members-only Content Exposed via Content API Plaintext and Excerpt Fields
- Affected
- >= 5.109.0, < 6.77.0
- Patched in
- 6.77.0
- highGHSA-fxxr-gqx3-p253Nov 13, 2026Brute-Force Protection Bypass via Concurrent Requests and Missing Rate Limits
- Affected
- >= 1.0.0-alpha.8, < 6.76.0
- Patched in
- 6.76.0
- highCVE-2026-84383Oct 1, 2026Memory Corruption via Crafted Image Uploads
- Affected
- >= 6.46.0, < 6.67.0
- Patched in
- 6.67.0
- highCVE-2026-105642Oct 1, 2026Remote Code Execution via Bookmark Card Images
- Affected
- >= 6.56.0, < 6.67.0
- Patched in
- 6.67.0
- highCVE-2026-105643Oct 1, 2026Stored XSS via Embed Card Previews
- Affected
- >= 6.34.0, < 6.67.0
- Patched in
- 6.67.0
- mediumCVE-2026-105644Oct 1, 2026Stored XSS via SVG Files in Content Imports
- Affected
- >= 4.0.0, < 6.67.0
- Patched in
- 6.67.0
- mediumCVE-2026-105645Oct 1, 2026Regular Expression Denial of Service in External Media Inliner
- Affected
- >= 5.37.0, < 6.67.0
- Patched in
- 6.67.0
- mediumCVE-2026-105646Oct 1, 2026Regular Expression Denial of Service in Content Import
- Affected
- >= 4.0.0, < 6.67.0
- Patched in
- 6.67.0
- mediumCVE-2026-105647Sep 24, 2026Server-Side Request Forgery in Bookmark Fetching
- Affected
- >= 6.54.1, < 6.65.0
- Patched in
- 6.65.0
- mediumCVE-2026-105648Sep 24, 2026Private IP Filtering Bypass via IPv6 Transition Addresses
- Affected
- >= 6.0.9, < 6.65.0
- Patched in
- 6.65.0
- highCVE-2026-105649Sep 24, 2026Stored XSS via SVG Uploads Bypassing Sanitization
- Affected
- >= 4.22.0, < 6.65.0
- Patched in
- 6.65.0
- highCVE-2026-105650Sep 17, 2026Stored XSS via oEmbed Photo Responses
- Affected
- >= 2.5.0, < 6.64.0
- Patched in
- 6.64.0
- highCVE-2026-105651Sep 17, 2026Stored XSS via Bookmark Card Images
- Affected
- >= 5.94.0, < 6.64.0
- Patched in
- 6.64.0
- lowCVE-2026-105652Sep 17, 2026Password Hash Ordering Disclosure in Ghost Admin API
- Affected
- >= 0.7.2, < 6.64.0
- Patched in
- 6.64.0
- highCVE-2026-105675Sep 17, 2026Invite Token Disclosure in Ghost Admin API
- Affected
- >= 4.39.0, < 6.64.0
- Patched in
- 6.64.0
- mediumCVE-2026-105676Sep 17, 2026Path Traversal via Locale Setting
- Affected
- >= 1.20.0, < 6.64.0
- Patched in
- 6.64.0
- highCVE-2026-105677Sep 17, 2026Remote Code Execution via Theme Translation Files
- Affected
- >= 6.10.3, < 6.64.0
- Patched in
- 6.64.0
- mediumCVE-2026-105678Sep 17, 2026Editors Could Promote Staff Users to Their Own Role
- Affected
- >= 0.5.0, < 6.64.0
- Patched in
- 6.64.0
- highCVE-2026-105679Sep 17, 2026Stored XSS via File Uploads on Local Storage
- Affected
- >= 6.22.1, < 6.64.0
- Patched in
- 6.64.0
- highGHSA-rcx7-6m7p-xw5cSep 11, 2026Restricted Content Bypass
- Affected
- >=v4.0.0, <v6.63.0
- Patched in
- v6.63.0
- highGHSA-ffmj-3ppp-cj4rSep 11, 2026Unauthenticated Staff Enumeration and Data Extraction via Blind Oracles
- Affected
- >=v2.10.0, <v6.63.0
- Patched in
- v6.63.0