Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tryghost/ghost

              main @ 3c8576d
            

235

Fixes

CVEs

CRITICAL

Peak severity

35.5%

Coverage

Highlights

Auth Bypass: 84 prior fixes. Scrutinize any change in this area.

ghost/members-api: most-fixed (6 issues). Treat as high-risk during review.

93 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in the 2FA logic and session-verification flows allowed staff users to bypass email verification and gain unauthorized administrative access. This matches CVE-2026-22594 where attackers could skip 2FA checks using unverified fields.

SSRF: Unrestricted URL parsing and resolving in bookmark generation and media-inlining utilities led to SSRF, allowing attackers to access sensitive internal cloud metadata and target private host IPs. This aligns with CVE-2026-22597 and CVE-2025-9862.

Stored XSS: The application historically permitted script execution inside SVG/SVGZ uploads. Lack of rigorous server-side DOMPurify sanitization in file-upload paths allowed attackers to perform Stored XSS and execute scripts in authenticated sessions. This relates directly to CVE-2024-23724.