CVEvulnerability

CVE-2026-105648

4.0 MEDIUM Published 2026-10-05 Modified 2026-10-06 Official page ↗

Status: Deferred
Published: 2026-10-05
Last modified: 2026-10-06
Assigner: [email protected]
CVSS 3.1 ([email protected]): 4.0 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weaknesses: CWE-184, CWE-918

Description

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

Weakness · CWE (2)

CWE-184 Incomplete List of Disallowed Inputs weakness
CWE-918 Server-Side Request Forgery weakness

References

https://github.com/TryGhost/Ghost/commit/20d3f792bf4a7c349ee56b746a067550d8684ff5 github.com
https://github.com/TryGhost/Ghost/pull/30917 github.com
https://github.com/TryGhost/Ghost/releases/tag/v6.65.0 github.com
https://github.com/TryGhost/Ghost/security/advisories/GHSA-r7f2-6fj8-6fg2 github.com

CVE-2026-105648

Description

Related

Weakness · CWE (2)

References