CVE-2026-26980
Unauthorized Database Read in Ghost CMS via Arbitrary Access
Publication date: 2026-02-20
Last updated on: 2026-05-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ghost | ghost | From 3.24.0 (inc) to 6.19.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-26980 is a critical SQL injection vulnerability found in the Content API of the Ghost blogging platform, affecting versions 3.24.0 through 6.19.0. It allows unauthenticated attackers to execute arbitrary SQL queries by exploiting improper sanitization of user-supplied input in the slug filter ordering parameter. This means attackers can read arbitrary data from the database without any privileges or user interaction.
The vulnerability arises because special SQL elements in the query string filter parameter are not correctly neutralized, enabling injection attacks. The issue was fixed in version 6.19.1 by refactoring the slug filter ordering logic to use parameterized queries instead of directly embedding user input into SQL strings.
How can this vulnerability impact me? :
This vulnerability can have a severe impact as it allows attackers to read sensitive data from the database without authentication or privileges, compromising the confidentiality and integrity of the data.
Since the attack vector is network-based with low complexity and no user interaction required, it poses a high risk to affected systems. The availability impact is low, but the exposure of sensitive information can lead to further exploitation or data breaches.
There is no application-level workaround because the Content API key is public by design, so mitigation requires updating to the fixed version or using network-level protections like reverse proxies or Web Application Firewalls to block malicious requests.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring network requests to the Ghost Content API for suspicious query string filter parameters that include patterns like "slug%3A%5B" or "slug:[", which are not properly sanitized and can lead to SQL injection.'}, {'type': 'paragraph', 'content': 'One approach is to inspect HTTP requests to the Content API endpoint and look for these suspicious slug filter patterns in the query string.'}, {'type': 'paragraph', 'content': 'For example, you can use network traffic capture tools like tcpdump or Wireshark to filter HTTP requests containing these patterns, or use command-line tools like curl or wget to test the API manually.'}, {'type': 'list_item', 'content': "Use tcpdump to capture HTTP requests containing suspicious slug filters: tcpdump -A -s 0 'tcp port 2368 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'slug%3A%5B\\|slug:\\['"}, {'type': 'list_item', 'content': "Use curl to test the Content API with a suspicious slug filter: curl 'http://your-ghost-site.com/ghost/api/v3/content/posts/?filter=slug:[test]'"}, {'type': 'paragraph', 'content': 'Additionally, deploying a Web Application Firewall (WAF) or reverse proxy to log and block requests containing these suspicious patterns can help detect exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary and most effective mitigation is to upgrade the Ghost platform to version 6.19.1 or later, where the vulnerability has been fixed by using parameterized queries to prevent SQL injection.'}, {'type': 'paragraph', 'content': 'Since the Content API key is public by design, restricting key access does not mitigate the issue.'}, {'type': 'paragraph', 'content': 'As a temporary mitigation before upgrading, you can deploy a reverse proxy or Web Application Firewall (WAF) to block or filter requests containing suspicious slug filter patterns such as "slug%3A%5B" or "slug:[".'}, {'type': 'paragraph', 'content': 'Be aware that this temporary mitigation may disrupt legitimate functionality that uses slug filters.'}] [1]