CVE-2026-103287

LOWCVSS 2.7

Description

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.

Timeline

Published:October 1st, 2026 11:17 AM

Last modified:October 6th, 2026 2:17 AM

CVSS Scoring

CVSS v3: 2.7 (LOW)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-918

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c
https://www.vulncheck.com/advisories/ghost-1.18.0-before-6.27.0-server-side-request-forgery-via-webhook

Source: NIST NVD · Data may lag official sources by up to one minute