CVE-2026-26980 Exploit Metadata

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

The artifact is a Python script (poc.py) that exploits CVE-2026-26980, an unauthenticated SQL injection in Ghost CMS Content API, to perform boolean-based blind data extraction from the database. It recovers admin email, name, API key ID, and secret, and enumerates table row counts.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Dockerfile, README.md, and poc.py for a public CVE-2026-26980 SQL injection proof-of-concept. The PoC demonstrates a boolean-based blind SQL injection against a vulnerable Ghost CMS instance to extract database metadata and API key material. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The code performs only the advertised exploit behavior against the specified target URL.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPython

Target softwareGhost CMS

Attack typesSQL Injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The Python script `poc.py` actively constructs and sends SQL injection payloads to a vulnerable Ghost CMS instance to extract sensitive data (admin credentials, API secrets) and enumerate database contents. This constitutes exploitation, not mere detection or scanning. The README describes it as a 'PoC' that 'demonstrates how a public Content API request can be turned into a boolean-based database read primitive' and the code performs the actual data extraction.

poc.py:1-237README.md:16README.md:129

Requirements

A target Ghost CMS instance vulnerable to CVE-2026-26980 (versions >= 3.24.0, < 6.19.1) with a known public Content API key.README.md:14README.md:22-24poc.py:7
The target must have two oracle tags named 'bacon' and 'chorizo' seeded in the database for the boolean-based extraction to function.README.md:155-158poc.py:30poc.py:176

Observed behavior

Sends HTTP GET requests to the Ghost Content API endpoint `/ghost/api/content/tags/` with a crafted `filter` parameter containing a SQL injection payload in the `slug:[...]` filter.poc.py:15-18poc.py:21-30
Uses a boolean-based blind SQL injection technique: the order of the returned tags ('bacon' first vs 'chorizo' first) reveals whether an injected SQL condition is true or false.poc.py:33-42README.md:155-158
Extracts database values character by character using a prefix-based GLOB search, recovering admin email, admin name, admin API key ID, and admin API secret.poc.py:45-80poc.py:210-213
Enumerates row counts for multiple database tables (settings, users, api_keys, posts, tags, posts_tags) using the same boolean oracle.poc.py:101-118poc.py:202-206

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: poc.py sends crafted HTTP requests to a user-supplied target URL to perform boolean-based blind SQL injection and extract database values.This is the normal, advertised exploit behavior for CVE-2026-26980 and does not constitute a backdoor.poc.py:1-237
Network Target: The PoC targets a user-supplied --url parameter (default http://127.0.0.1:9102).The target is explicitly provided by the user; the script does not contain hardcoded exfiltration to an attacker-controlled server.poc.py:170
Hardcoded Credential: DEFAULT_CONTENT_API_KEY = 'EQSTLab299'This is a lab-specific Content API key used for the demonstration; it is not a backdoor credential and is documented in the README.poc.py:7README.md:55-56

Review boundaries

What the analysis did not establish

The evidence packet includes only three text files (Dockerfile, README.md, poc.py) out of eight total files; two non-text media files and three additional text files are omitted, so the full repository content is not available for review.
The analysis is based solely on static source code review; the code was not executed, and its behavior is inferred from the provided text.
Five files in the repository were not included in the text evidence: docker-entrypoint.sh, patch-source-theme.sh, and two PNG assets (eqst01.png, work-mode.png) were reported as non-text media or omitted text files. Their content was not reviewed.
The analysis is limited to static review of the provided text; the code was not executed, and no dynamic behavior was observed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

Repository root

Created 2026-05-27Vuln labCVE-2026-26980Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud · 2026-08-03

Environment assessment

A Dockerized Ghost CMS 6.19.0 lab seeded with a public Content API key, oracle tags, and a flag table, designed to demonstrate CVE-2026-26980 SQL injection via the Content API filter parameter.

Dockerfile:1-50docker-entrypoint.sh:1-123README.md:1-270

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2026-26980, the Dockerfile builds a vulnerable Ghost 6.19.0 instance, the entrypoint seeds a flag and oracle tags, and poc.py demonstrates boolean-based SQL injection data extraction.

README.md:1-4Dockerfile:4docker-entrypoint.sh:1-123poc.py:1-237

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Ghost CMS 6.19.0

vulnerable target application

The vulnerable Ghost CMS instance installed via ghost-cli, serving on port 9102 with a SQLite database. It exposes the public Content API used for the SQL injection exercise.

Dockerfile:4Dockerfile:6-7Dockerfile:24docker-entrypoint.sh:1-123

docker-entrypoint.sh

lab initializerdatabase seeder

Shell script that starts Ghost, waits for readiness, then seeds the SQLite database with a flag table, oracle tags (bacon, chorizo), a static Content API key, and lab branding. It also starts Ghost in development mode as the final process.

Dockerfile:28Dockerfile:50docker-entrypoint.sh:1-123

patch-source-theme.sh

theme patcher

Shell script that modifies the Ghost source theme to display lab-specific branding and CVE identifier in the header and email subscription placeholder.

Dockerfile:29patch-source-theme.sh:1-12

poc.py

exploit demonstration script

Python script that demonstrates CVE-2026-26980 by sending crafted Content API requests with SQL injection payloads to perform boolean-based data extraction (email, password hash length, API keys, table row counts) from the Ghost database.

poc.py:1-237README.md:1-4

assets (eqst01.png, work-mode.png)

lab branding images

Binary image files copied into the container for lab logo and post feature image. eqst01.png is a BINARY; work-mode.png is uninspected due to size.

Dockerfile:30-31docker-entrypoint.sh:44-45

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-26980

Supported by supplied evidence

The lab builds Ghost 6.19.0, which is within the affected range (<6.19.1). The README describes the SQL injection in the Content API slug filter ordering, and poc.py demonstrates a working boolean-based SQL injection that extracts database values via the public Content API.

Dockerfile:4README.md:1-4README.md:15-17poc.py:1-237

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed to build and run the container.README.md:27-29
The lab must be built with 'docker build -t cve-2026-26980 .' and run with port 9102 published.README.md:27-29
The target Ghost instance must be reachable at the provided URL (default http://127.0.0.1:9102).poc.py:1-237README.md:27-29
A valid Ghost Content API key is required; the lab seeds 'EQSTLab299' as the default.docker-entrypoint.sh:7poc.py:7

Evidence-described exercise path

Build the Docker image: 'docker build -t cve-2026-26980 .'README.md:27-28
Run the container: 'docker run --rm -d -p 9102:9102 --name cve-2026-26980 cve-2026-26980'README.md:28-29
Execute the PoC script: 'python3 poc.py --url http://127.0.0.1:9102' (optionally with --key).README.md:67-71
Observe the script calibrate the boolean oracle, perform reconnaissance (lengths, row counts), extract admin email, name, API key ID, and secret, and print a database snapshot.poc.py:1-237README.md:79-100

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab container: building a vulnerable Ghost instance, seeding a local SQLite database with exercise data, and running a PoC script that sends HTTP requests to the lab's own Content API. No host escape, external connections, persistence outside the container, credential theft beyond the lab's own seeded keys, or destructive actions are observed.

Dockerfile:1-50docker-entrypoint.sh:1-123poc.py:1-237

Review boundaries

What the analysis did not establish

Two asset files are uninspected: eqst01.png (BINARY) and work-mode.png (omitted oversized source file). Their content cannot be verified, but they are only used as static images for lab branding.
The Dockerfile uses 'USER root' temporarily to copy files and run the theme patch script, which is a common pattern but could be a concern if the scripts were malicious; however, the scripts are provided and show only lab setup actions.
The PoC script extracts database values including an admin API secret, but this is part of the demonstrated vulnerability impact and targets the lab's own seeded data.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted · 1 binary file not inspected

Linked vulnerabilities

CVE-2026-26980