CVE-2026-105682

LOWCVSS 2.7

Description

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.

Timeline

Published:October 5th, 2026 8:17 PM

Last modified:October 5th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 2.7 (LOW)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-918

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/commit/815962dd2760e55c5dc8d0fb7fac732a7634566f
https://github.com/TryGhost/Ghost/issues/27219
https://github.com/TryGhost/Ghost/releases/tag/v6.27.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c

Source: NIST NVD · Data may lag official sources by up to one minute