CVE-2025-9862 Ghost 6.0.6 - SSRF via oEmbed Bookmark
Attackers can exploit an SSRF vulnerability in Ghost's oEmbed feature to access internal network resources.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9862?
CVE-2025-9862 is a medium-severity server-side request forgery vulnerability in Ghost, published on 17 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.
Weakness: CWE-918
Which versions are affected by CVE-2025-9862?
5 open source packages ship an affected version, including ghost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 5.99.0 | 5.130.5, 6.0.9 |
ghost npm | From 5.99.0 | 5.130.4 |
ghost npm | From 5.99.0 | 5.130.4 |
ghost npm | From 6.0.0 | 6.0.9 |
ghost npm | From 6.0.0 | 6.0.9 |
Products include Ghost Ghost.
How do I fix CVE-2025-9862?
Upgrade ghost to a fixed version for your release line: 5.130.5, 6.0.9 or 5.130.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-9862 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9862 exists.
Other vulnerabilities in Ghost
Sources
Also known as BIT-ghost-2025-9862, GHSA-f7qg-xj45-w956.