CVE-2026-26980

GitHubCurated repository PoCExploitC++SecureWithUmer/CVE-2026-PoCs

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-26980, an unauthenticated blind SQL injection in Ghost CMS's Content API. The code performs automated setup, boolean-based data extraction (admin email, password hash, API key), and fix validation against a Dockerized Ghost instance.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, Docker Compose file, Python exploit script, and shell validation script for CVE-2026-26980, a SQL injection vulnerability in Ghost CMS. All code performs expected PoC behavior: setting up a vulnerable Ghost instance, exploiting the SQL injection to extract database data, and validating the fix. No concealed executable behavior, persistence, credential exfiltration to external parties, or unrelated payloads were observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonShellYAML
Target softwareGhost CMS
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (exploit.py) that actively exploits CVE-2026-26980 by sending malicious SQL injection payloads to extract data from a vulnerable Ghost CMS instance. The README describes it as a 'Full PoC: setup, verify, extract' and the code includes functions for data extraction (extract_admin_email, extract_password_hash, extract_admin_api_secret).

dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:1-4dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:296-316dinosn-ghost-cve-2026-26980-194f7c1/README.md:224

Requirements

  • A running, vulnerable Ghost instance (versions 3.24.0 through 6.19.0) with MySQL 8.dinosn-ghost-cve-2026-26980-194f7c1/README.md:11dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:14
  • Python 3.8+ with the 'requests' library installed.dinosn-ghost-cve-2026-26980-194f7c1/README.md:116
  • Docker and Docker Compose for the provided lab environment.dinosn-ghost-cve-2026-26980-194f7c1/README.md:115

Observed behavior

  • Automatically sets up a Ghost admin user or logs in if already configured.dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:117-157
  • Retrieves the public Content API key via admin API, custom integration creation, or HTML scraping.dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:159-191
  • Sends crafted HTTP requests to the Content API with a malicious filter parameter containing a SQL injection payload that uses an error-based boolean oracle (EXP(710) overflow).dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:208-236
  • Performs binary search extraction of database values, including admin email, bcrypt password hash, and admin API secret.dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:256-316
  • Includes a fix validation mode that confirms the target is not vulnerable.dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:363-383
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Python script exploit.py performs SQL injection via Ghost Content API to extract admin email, password hash, and API key from the local vulnerable instance.This is the expected behavior of a PoC for CVE-2026-26980, which describes unauthenticated arbitrary database reads.dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:296-316
Network Communication
All HTTP requests in exploit.py target the user-supplied --url parameter (default http://localhost:2368) and the Ghost admin/content API endpoints on that host.No external or hardcoded exfiltration endpoints are present; all data stays within the local test environment.dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:72-95
Setup Script
validate.sh starts Docker containers, runs the exploit, and optionally tears down the environment.Standard lab automation; no hidden commands or external downloads beyond the declared Docker images and pip requirements.dinosn-ghost-cve-2026-26980-194f7c1/validate.sh:1-40
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository unit are included. The packet metadata notes 7 non-text media files (screenshots) and 1 unclassified file that were not analyzed, but all 4 selected text files are complete.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness is not verified.
  • Seven non-text media files (screenshots) and one unclassified 17-byte file were present in the artifact but not analyzed; they are flagged as metadata-only and could theoretically contain steganographic payloads, though this is unlikely for a PoC repository.
  • The review does not verify the safety of the Docker images (ghost:6.18.0, ghost:6.19.1, mysql:8.0) or the pip requirements.txt, which are external dependencies.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml

Created Vuln labCVE-2026-26980Compose · images

1 Compose manifest · 4 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs a vulnerable Ghost CMS 6.18.0 instance with MySQL 8.0, and optionally a fixed Ghost 6.19.1 instance, to demonstrate and validate CVE-2026-26980, an unauthenticated SQL injection in the Content API.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:1-882026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:1-239

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'Ghost CMS Vulnerability Lab' for CVE-2026-26980, provides a vulnerable Ghost version, a fixed version for validation, and includes a full exploit script. The Docker Compose file defines services for both vulnerable and fixed targets.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:12026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:3-72026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:1-88
Lab shapeCompose · images
Services4
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

ghost-vuln

vulnerable target

Runs Ghost CMS 6.18.0, which is within the affected range for CVE-2026-26980. Exposes port 2368 on the host. Connects to the db-vuln MySQL service.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:11-26

db-vuln

database for vulnerable target

MySQL 8.0 database service for the vulnerable Ghost instance. Stores data in a named volume db_vuln_data.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:28-42

ghost-fixed

fixed target for validation

Runs Ghost CMS 6.19.1, the patched version. Exposes port 2369 on the host. Only started with the 'fixed' profile. Connects to the db-fixed MySQL service.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:44-62

db-fixed

database for fixed target

MySQL 8.0 database service for the fixed Ghost instance. Stores data in a named volume db_fixed_data. Only started with the 'fixed' profile.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:64-78

exploit.py

exploit script

Python script that automates setup, verification, and data extraction for CVE-2026-26980. It uses an error-based boolean blind SQL injection technique against the Ghost Content API.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:1-417

validate.sh

validation script

Bash script that starts both vulnerable and fixed services, runs the exploit against each, and optionally tears down the environment.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/validate.sh:1-40
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-26980

Supported by supplied evidence

The entire lab is built around CVE-2026-26980. The README describes the vulnerability, affected versions, and fix. The Docker Compose file provides a vulnerable Ghost 6.18.0 instance. The exploit script targets the described SQL injection in the Content API slug filter ordering.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:12026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:3-72026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:19-272026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:11-262026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:1-417
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:113-114
  • Python 3.8+ with the 'requests' library installed.2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:1152026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/requirements.txt:1
  • The vulnerable Ghost instance must be fully initialized (approximately 45 seconds) before running the exploit.2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:123-124

Evidence-described exercise path

  1. Start the vulnerable Ghost 6.18.0 and MySQL 8.0 services using 'docker compose up -d'.2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:122-123
  2. Wait approximately 45 seconds for Ghost to initialize.2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:123-124
  3. Run the exploit script: 'python3 exploit.py --url http://localhost:2368'. The script will set up an admin user if needed, obtain the Content API key, verify the SQL injection, and extract the admin email.2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:124-1252026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:1-417
  4. Optionally, start the fixed Ghost 6.19.1 with 'docker compose --profile fixed up -d' and validate the fix with 'python3 exploit.py --url http://localhost:2369 --validate-fix'.2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:129-133
  5. Tear down the environment with 'docker compose --profile fixed down -v'.2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/README.md:140-141
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable Ghost target. The exploit script extracts data from the lab's database, which is expected for a vulnerability demonstration. There is no evidence of host escape, external connections, persistence, credential theft outside the lab, or destructive actions. Port mappings and volume mounts are standard for a lab environment.

2026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:1-882026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:1-4172026/CVE-2026-26980/dinosn-ghost-cve-2026-26980-194f7c1/validate.sh:1-40
Review boundaries

What the analysis did not establish

  • The packet includes binary screenshot files that were not inspected.
  • The exploit script contains hardcoded admin credentials for lab setup, but this is within the lab context.
  • CVE-2026-29053 is mentioned in the README but is not part of the selected unit CVE IDs; no exploit or lab component for it is provided.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2