CVE-2025-9862
Ghost 6.0.6 (5.99.0–5.130.3, 6.0.0–6.0.8; fixed 5.130.4/6.0.9)
- Class
- SSRF
- Severity
- Medium · CVSS 4.0 score 6.1
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- regida
- Affected
- Ghost 6.0.6 (5.99.0–5.130.3, 6.0.0–6.0.8; fixed 5.130.4/6.0.9)
The defect
SSRF via oEmbed bookmark
Class overview · SSRF
The server is asked to fetch a URL the attacker chooses. The request comes from inside the service's own network position, reaching things the attacker cannot reach directly: internal endpoints, cloud metadata or unauthenticated services.