CVE-2026-105647

MEDIUMCVSS 4.0

Description

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

Timeline

Published:October 5th, 2026 8:17 PM

Last modified:October 5th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 4.0 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-367 CWE-918

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/commit/3f8594eb53de883ac017545c358f59039cb152de
https://github.com/TryGhost/Ghost/pull/30918
https://github.com/TryGhost/Ghost/releases/tag/v6.65.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9

Source: NIST NVD · Data may lag official sources by up to one minute