CVEvulnerability

CVE-2026-105682

2.7 LOW Published 2026-10-05 Modified 2026-10-06 Official page ↗

Status: Deferred
Published: 2026-10-05
Last modified: 2026-10-06
Assigner: [email protected]
CVSS 3.1 ([email protected]): 2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-918

Description

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.

Weakness · CWE (1)

CWE-918 Server-Side Request Forgery weakness

References

https://github.com/TryGhost/Ghost/commit/815962dd2760e55c5dc8d0fb7fac732a7634566f github.com
https://github.com/TryGhost/Ghost/issues/27219 github.com
https://github.com/TryGhost/Ghost/releases/tag/v6.27.0 github.com
https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c github.com

CVE-2026-105682

Description

Related

Weakness · CWE (1)

References