CVE-2026-103291

MEDIUMCVSS 6.4

Description

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network endpoints to access metadata services and internal resources unavailable from the public internet.

Timeline

Published:October 1st, 2026 11:17 AM

Last modified:October 6th, 2026 2:17 AM

CVSS Scoring

CVSS v3: 6.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-918

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/security/advisories/GHSA-rrq6-9r3c-7w26
https://www.vulncheck.com/advisories/ghost-3.20.2-before-6.51.0-ssrf-via-image-size-fetch

Source: NIST NVD · Data may lag official sources by up to one minute