CVE-2026-105648

MEDIUMCVSS 4.0

Description

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

Timeline

Published:October 5th, 2026 8:17 PM

Last modified:October 5th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 4.0 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-184 CWE-918

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/commit/20d3f792bf4a7c349ee56b746a067550d8684ff5
https://github.com/TryGhost/Ghost/pull/30917
https://github.com/TryGhost/Ghost/releases/tag/v6.65.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-r7f2-6fj8-6fg2

Source: NIST NVD · Data may lag official sources by up to one minute