HarborGuard / CVE
Back to search
CRITICALCVE-2026-26980Published Modified CNA GitHub_M

CVE-2026-26980: Ghost has a SQL Injection in its Content API

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

Metrics

CVSS v3.1
9.4
Severity
CRITICAL
Fixed in
—
Affected Products
1
Affected packages
  • TryGhost / Ghost
    >= 3.24.0, < 6.19.1
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
References