BIT-ghost-2025-9862

vendorUSosv

Ghost 6.0.6 - SSRF via oEmbed Bookmark

view advisory published 2026-01-29Licence: per source

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-9862US	medium6.5	0.52% (44th)	—	2025-09-17
Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.…

references

External citations — patches, advisories, analysis.

https://fluidattacks.com/advisories/regidaADVISORY
https://github.com/TryGhost/GhostWEB
https://github.com/TryGhost/Ghost/releases/tag/v6.0.9FIX
https://github.com/TryGhost/Ghost/security/advisories/GHSA-f7qg-xj45-w956ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-9862WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan