CVE-2026-103285: Tryghost Ghost

Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days.

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when visited by authenticated members without their knowledge or consent.

Affected products

• Tryghost Ghost: from 5.19.0, before 6.57.1 (fixed in 6.57.1)

Published 2026-10-01. Last modified 2026-10-01.