CVE-2026-26980 Ghost CMS SQL Injection PoC

This repository contains a Go-based proof-of-concept tool for demonstrating and validating the Ghost CMS Content API SQL injection vulnerability described by CVE-2026-26980. The implementation is based on the exploit flow implemented in the main Go source file and is intended for authorized security research and testing only.

Overview

The PoC targets Ghost CMS instances affected by a Content API slug filter ordering vulnerability. It can:

• verify whether a target is vulnerable to SQL injection
• retrieve a Content API key when possible
• enumerate a slug anchor
• extract an administrator email address
• optionally extract the admin password hash and admin API secret
• validate whether a patched target is no longer vulnerable

Affected Versions

The implementation is specifically referenced against the following advisory context:

• Affected versions: Ghost CMS 3.24.0 through 6.19.0
• Fixed version: Ghost CMS 6.19.1
• CVE: CVE-2026-26980
• CWE: CWE-89
• Advisory: GHSA-w52v-v783-gw97

Project Structure

• ghost_sqli_cms.go: main Go implementation of the exploit and CLI
• ghost_sqli/: supporting assets or related resources
• images/: screenshots or reference material
• go.mod: Go module definition

Requirements

• Go 1.26.4 or a compatible newer version
• Network access to the target Ghost CMS instance
• A target that is either vulnerable or intended for validation testing

Clone And Install

git clone https://github.com/gagaltotal/CVE-2026-26980-Ghost-CMS-Api
cd CVE-2026-26980-Ghost-CMS-Api
go mod init CVE-2026-26980-Ghost-CMS-Api
go mod tidy

Building the Tool

From the project root, build the binary with:

go build -o ghost-sqli ghost_sqli_cms.go
OR
go run ghost_sqli_cms.go

Usage

Use Help

./ghost-sqli --help

Basic exploitation

./ghost-sqli --url http://target.example:2368

Extract password hash and API secret

./ghost-sqli --url http://target.example:2368 --extract-password --extract-api-key

Validate that a patched instance is fixed

./ghost-sqli --url http://target.example:2368 --validate-fix

Use an existing Content API key

./ghost-sqli --url http://target.example:2368 --content-key "your-content-api-key"

Enable verbose output

./ghost-sqli --url http://target.example:2368 -v

Command Line Options

• --url : target Ghost CMS base URL (required)
• --validate-fix: test whether the target is no longer vulnerable
• --extract-password: also extract the admin bcrypt hash
• --extract-api-key: also extract the admin API secret
• --content-key : skip setup and use a supplied Content API key
• -v, --verbose: enable debug output
• -h, --help: show help information

Security Notice

This project is provided for educational and authorized security assessment purposes only. Use it only against systems you own, are authorized to test, or are evaluating in a controlled environment. Unauthorized access or exploitation of third-party systems is illegal and may violate applicable laws.

Notes

• The tool performs setup and authentication steps against the target instance when possible.
• Some targets may require manual adjustment depending on Ghost CMS versioning and deployment configuration.
• Results may vary depending on the target environment, response behavior, and whether the vulnerability is patched.

References

• Ghost CMS security advisories
• CVE-2026-26980
• GHSA-w52v-v783-gw97