CVE-2026-26980 — Ghost has a SQL Injection in its Content API
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fi…
Published: 2026-02-20 · CVSS: 9.4 · CVSS 3.1
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7