Ghost is usually honest about announcing itself, so finding a site's version takes about ten seconds. Here's how I do it, fastest method first.
Quickest way: run a full scan
Point ScanTower's full scan at the URL. The technology section reads the version straight off the page:
| Signal | Source | Confidence | Value |
|---|---|---|---|
| Generator meta tag | HTML | 95 / 100 | Ghost 5.120 |
It doesn't stop at the number. Once it knows you're on Ghost 5.120, it checks that release against published CVEs and flags the ones that apply - which is the part that actually matters.
Read the meta tag yourself
Want to see it directly? View source and search for generator, or use one line in the terminal:
curl -s https://example.com/ | grep -i generatorOn a stock install you'll find this in the <head>:
<meta name='generator' content='Ghost 5.120' />Why confidence is 95, not 100
The tag is self-reported. A theme can strip it, and an operator can fake the version up or down. It's accurate most of the time because most people never touch it - but if the answer matters, confirm it against something the site can't edit.
When the tag is missing
Security-aware sites remove it. Ghost still leaves tells: the versioned Portal script (portal.min.js), the /ghost/ admin and /ghost/api/ paths, default Casper/Source theme assets, and /members/ endpoints. Stacked together they'll usually pin down a version range. The full scan checks these automatically.
Why the version matters: CVEs
A version number is really one question: has the site been patched? Ghost fixes things fast, but self-hosters fall behind. Using 5.120 as the example, here are real issues that hit that part of the 5.x line - always confirm the exact range against the official advisory:
| CVE | Type | Affected | Fixed in |
|---|---|---|---|
| CVE-2026-22597 | SSRF via media inliner (authenticated) | 5.38.0 - 5.130.5 | 5.130.6 |
| CVE-2026-24778 | XSS via a crafted link | 5.43.0 - 5.120.4 | later 5.x |
| Pre-5.76.0 excerpt XSS | Stored XSS in post excerpts | before 5.76.0 | 5.76.0 |
5.120 sits inside more than one of these windows. None are one-click takeovers, but an XSS that reaches an admin session is how a "low-risk" finding becomes a full compromise.
If it's your site
- Update.
ghost updateon self-hosts; Ghost(Pro) is already current. See the changelog. - Lock down
/ghost/with 2FA and, ideally, IP restrictions. - Re-scan to confirm the version moved and the CVE flags cleared.
While you're at it, the security headers checker and HTTP security checker catch the misconfigurations that often ride along with an out-of-date CMS. Run the full scan and let it read the tag, check the fingerprints, and line it up against the CVE history in one pass.