Task #6: Ghost CMS Security Update — ✅ COMPLETE #91

New Issue

mkrause612 · 2026-03-20T21:05:25-05:00

mkrause612 commented

2026-03-20 21:05:25 -05:00

Task #6: Ghost CMS Security Update — ✅ COMPLETE

Time Estimate: 15-30 minutes (actual: ~20 minutes)

Documentation: docs/tasks/ (see operations manual)

Time: 15-30 minutes (actual: ~20 minutes)
Status: COMPLETE — March 13, 2026
Priority: Tier 0 — Critical Security
Documentation: docs/tasks/ghost-security-update/

Ghost CMS at firefrostgaming.com is running v6.16.1, vulnerable to two active CVEs. No workaround exists — must update to 6.19.3.

CVEs:

CVE-2026-26980 (CVSS 9.4 Critical) — SQL injection in Content API, unauthenticated DB read
CVE-2026-29784 (CVSS 7.5 High) — CSRF account takeover via session/verify endpoint

Key Deliverables:

Ghost updated to v6.19.3 on Ghost VPS (64.50.188.14)
Site verified operational post-update
Infrastructure manifest updated (Ghost CMS was undocumented)

Dependencies: Requires SSH access to Ghost VPS (64.50.188.14)

See task directory for complete update procedure (CLI and Docker paths both documented).

Source: docs/core/tasks.md (Task #6)

### Task #6: Ghost CMS Security Update — ✅ COMPLETE **Time Estimate:** 15-30 minutes (actual: ~20 minutes) **Documentation:** `docs/tasks/` (see operations manual) --- **Time:** 15-30 minutes (actual: ~20 minutes) **Status:** COMPLETE — March 13, 2026 **Priority:** Tier 0 — Critical Security **Documentation:** `docs/tasks/ghost-security-update/` Ghost CMS at firefrostgaming.com is running v6.16.1, vulnerable to two active CVEs. No workaround exists — must update to 6.19.3. **CVEs:** - CVE-2026-26980 (CVSS 9.4 Critical) — SQL injection in Content API, unauthenticated DB read - CVE-2026-29784 (CVSS 7.5 High) — CSRF account takeover via session/verify endpoint **Key Deliverables:** - Ghost updated to v6.19.3 on Ghost VPS (64.50.188.14) - Site verified operational post-update - Infrastructure manifest updated (Ghost CMS was undocumented) **Dependencies:** Requires SSH access to Ghost VPS (64.50.188.14) **See task directory for complete update procedure (CLI and Docker paths both documented).** --- --- **Source:** `docs/core/tasks.md` (Task #6)

mkrause612 added the

area/website for/michael labels 2026-03-20 21:05:25 -05:00

mkrause612 referenced this issue from a commit

2026-04-04 11:27:32 -05:00

Add Task #91: Fix Server Matrix node detection

mkrause612 referenced this issue from a commit