CVE-2025-9862

Ghost 6.0.6 - SSRF via oEmbed Bookmark

6.1 MediumFix available

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: None

Exploit likelihood

0.52%Up 0.5 points since Sep 18, 2025

What each source reports

CVE List Score used 6.1

Ghost 6.0.6 - SSRF via oEmbed Bookmark

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

Record: CVE-2025-9862
CVSS 4.0: 6.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2025-29242 6.1

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

Record: EUVD-2025-29242
CVSS 4.0: 6.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f7qg-xj45-w956 6.1

Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark

Impact

A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF.

Vulnerable versions

This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8.

Patches

v5.130.4 and v6.0.9 contain a fix for this issue.

References

The original report is available here: https://fluidattacks.com/advisories/regida

We thank Cristian Vargas for discovering and disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email us at [email protected].

Record: GHSA-f7qg-xj45-w956
CVSS 4.0: 6.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 6.1

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

Record: CVE-2025-9862
CVSS 4.0: 6.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 6.1

Ghost 6.0.6 - SSRF via oEmbed Bookmark

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

Record: CVE-2025-9862
CVSS 4.0: 6.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness: CWE-918
Updated: 2026-11-02

OSVGHSA-f7qg-xj45-w956 6.1

Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark

Impact

A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF.

Vulnerable versions

This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8.

Patches

v5.130.4 and v6.0.9 contain a fix for this issue.

References

The original report is available here: https://fluidattacks.com/advisories/regida

We thank Cristian Vargas for discovering and disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email us at [email protected].

Record: GHSA-f7qg-xj45-w956
CVSS 4.0: 6.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness: CWE-918
Updated: 2026-11-02

OSVBIT-ghost-2025-9862 No score

Ghost 6.0.6 - SSRF via oEmbed Bookmark

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

Record: BIT-ghost-2025-9862
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ghost` npm	6.0.0 to 6.0.8	6.0.9
`ghost` npm	5.99.0 to 5.130.3	5.130.4
`ghost` Bitnami	5.99.0 up to 5.130.5, 6.0.0 up to 6.0.9	5.130.56.0.9
`ghost` npm	6.0.0 up to 6.0.9	6.0.9
`ghost` npm	5.99.0 up to 5.130.4	5.130.4

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-9862 is a medium vulnerability (CVSS 6.1) in Ghost, published September 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in ghost 6.0.9.