Home > Vulnerability Database > CVE-2025-9862

Mend.io Vulnerability Database

CVE-2025-9862

Good to know:

Date: September 17, 2025

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

Severity Score

0.0

Related Resources (9)

Url: https://github.com/TryGhost/Ghost/releases/tag/v6.0.9

Url: https://github.com/TryGhost/Ghost/commit/ffe9d079afa68557c581d224f1ff126e625b06e3

Url: https://github.com/TryGhost/Ghost

Url: https://fluidattacks.com/advisories/regida

Url: https://help.fluidattacks.com/portal/en/kb/articles/regida

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-9862

Url: https://github.com/TryGhost/Ghost/security/advisories/GHSA-f7qg-xj45-w956

Url: https://github.com/TryGhost/Ghost/commit/01d64c7c0ffbf90cd036195c60ded6d08077d612

Url: https://www.mend.io/vulnerability-database/CVE-2025-9862

Weakness Type (CWE)

Server-Side Request Forgery (SSRF)

CWE-918

Top Fix

Upgrade Version

Upgrade to version ghost - 6.0.9;ghost - 5.130.4;https://github.com/TryGhost/Ghost.git - v6.0.9;https://github.com/TryGhost/Ghost.git - v5.130.4

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	HIGH
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE