1name: crowdsecurity/vpatch-CVE-2026-26980
2description: 'Detects SQL injection in Ghost CMS Content API filter parameter (CVE-2026-26980).'
3rules:
4  - and:
5      - zones:
6          - URI
7        transform:
8          - urldecode
9          - lowercase
10        match:
11          type: contains
12          value: '/ghost/api/content/'
13      - zones:
14          - ARGS_NAMES
15        transform:
16          - urldecode
17          - lowercase
18        match:
19          type: contains
20          value: 'key'
21      - or:
22        - zones:
23            - ARGS
24          variables:
25            - filter
26          transform:
27            - urldecode
28            - lowercase
29          match:
30            type: contains
31            value: '||'
32        - zones:
33            - ARGS
34          variables:
35            - filter
36          transform:
37            - urldecode
38            - lowercase
39          match:
40            type: contains
41            value: '&&'
42labels:
43  type: exploit
44  service: http
45  confidence: 3
46  spoofable: 0
47  behavior: 'http:exploit'
48  label: 'Ghost - SQLI'
49  classification:
50    - cve.CVE-2026-26980
51    - attack.T1190
52    - cwe.CWE-89