Servers and applications
GHSA-p6x5-mfv9-84qx
Imported Media Fetched Over Plaintext HTTP for Protocol-Relative URLs
- Severity
- Low 3.1
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 6.76.0
- Weakness
- Cleartext transmission (CWE-319)
- Attack
- Over the network · Only under certain conditions · No login needed · Needs someone to click or open something
- Attacker can
- Change some data
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N- Sources
- Project advisories (GitHub)
Description
When importing content, Ghost can download externally hosted media and store copies on the site. Some media URLs were downloaded over plaintext HTTP even when the media host supports HTTPS.
An attacker able to intercept network traffic between the Ghost server and the media host could replace these files with content of their choice, which would then be stored and served by the site. Media downloading only happens when an Administrator imports content.
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
Affected software
| Software | Affected versions |
|---|---|
GhostServers and applications · github:tryghost/ghost |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-p6x5-mfv9-84qx
- github.com https://github.com/TryGhost/Ghost/security/advisories/GHSA-p6x5-mfv9-84qx