CVE-2026-103285 Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-103285?
CVE-2026-103285 is a medium-severity vulnerability in TryGhost Ghost, published on 1 Oct 2026.
Official description
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when visited by authenticated members without their knowledge or consent.
Weakness: CWE-352
Which versions are affected by CVE-2026-103285?
1 open source package ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 5.19.0 | 6.57.1 |
How do I fix CVE-2026-103285?
Upgrade ghost to 6.57.1 or later.
Is CVE-2026-103285 being exploited?
There is no known exploitation of CVE-2026-103285 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-103285, GHSA-264f-w588-vx62, GHSA-mf3j-vxq2-vmc4, MINI-4pvv-2m25-f5hw.