Servers and applications
GHSA-9wp5-gvxp-8wv6
Denial of Service via Crafted Revue Import
- Severity
- Medium 6.5
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 6.76.0
- Attack
- Over the network · No login needed · Needs someone to click or open something
- Attacker can
- Take it down
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H- Sources
- Project advisories (GitHub)
Description
A crafted Revue export file could make Ghost's Revue importer keep the Ghost process busy for a long time, during which the site stops responding to all visitors and staff.
Revue imports can only be run by an Administrator, so an attacker would need to convince an Administrator to import a crafted file. The effect lasts until processing finishes or Ghost is restarted. No data is exposed or changed.
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Affected software
| Software | Affected versions |
|---|---|
GhostServers and applications · github:tryghost/ghost |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-9wp5-gvxp-8wv6
- github.com https://github.com/TryGhost/Ghost/security/advisories/GHSA-9wp5-gvxp-8wv6