BIT-ghost-2026-22596

vendorUSosv

Ghost has SQL Injection in Members Activity Feed

view advisory published 2026-01-13Licence: per source

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-22596US	high7.2	0.47% (40th)	—	2026-01-10
Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allow…

references

External citations — patches, advisories, analysis.

https://github.com/TryGhost/Ghost/commit/cda236e455a7a30e828b6cba3c430e5796ded955FIX
https://github.com/TryGhost/Ghost/commit/f2165f968bcdaae0e35590b38fa280ab03239391FIX
https://github.com/TryGhost/Ghost/security/advisories/GHSA-gjrp-xgmh-x9qqADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-22596WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan