{"id":"CVE-2026-105682","aliases":["BIT-ghost-2026-103287","BIT-ghost-2026-105682","EUVD-2026-92773","GHSA-354h-gmhv-mr9c"],"status":"published","title":"Ghost: Server-Side Request Forgery in Webhook Trigger","description":"Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0024,"percentile":0.15273,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-10-01T10:42:21.818Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"npm","package":"ghost","fixed_in":["6.27.0"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ghost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"6.27.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"1.18.0"},{"fixed":"6.27.0"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"1.18.0"},{"fixed":"6.27.0"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"1.18.0"},{"fixed":"6.27.0"}]}],"bundled":2}],"products":[{"vendor":"tryghost","product":"ghost"}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://github.com/TryGhost/Ghost/issues/27219","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/TryGhost/Ghost/commit/815962dd2760e55c5dc8d0fb7fac732a7634566f","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.27.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105682","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-354h-gmhv-mr9c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103287","tags":["web","advisory"]},{"url":"https://www.vulncheck.com/advisories/ghost-1.18.0-before-6.27.0-server-side-request-forgery-via-webhook","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103287.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105682.json","tags":["advisory"]},{"url":"https://github.com/TryGhost/Ghost","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-105682","title":"Ghost: Server-Side Request Forgery in Webhook Trigger","description":"Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.","status":"published","published":"2026-10-05T19:29:22.093Z","modified":"2026-10-06T13:42:38.251Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-92773","description":"Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.","status":"published","published":"2026-10-05T19:29:22Z","modified":"2026-10-06T13:42:38Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:37.923108Z"}],"ghsa":[{"id":"GHSA-354h-gmhv-mr9c","title":"Ghost: Server-Side Request Forgery in Webhook Trigger","description":"### Impact\n\nAn SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v1.18.0 up to v6.27.0.\n\n### Patches\n\nv6.27.0 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). \n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). \n\n### References\n\nGhost thanks [0xkakash1](https://github.com/0xkakash1), [rooks00](https://github.com/rooks00), [l3tchupkt](https://github.com/l3tchupkt), [Wernerina](https://github.com/Wernerina), krn0@bugcrowdninja.com, and [Mohamed Bassia](https://github.com/0xBassia) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).","status":"published","published":"2026-10-07T16:17:57Z","modified":"2026-10-07T16:17:58Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:41:28.013673Z"}],"nvd":[{"id":"CVE-2026-105682","description":"Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.","status":"published","published":"2026-10-05T20:17:16.647Z","modified":"2026-10-06T15:03:59.427Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:54.129949Z"}],"osv":[{"id":"CVE-2026-103287","title":"Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook","description":"Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.","status":"published","published":"2026-10-01T10:42:21.818Z","modified":"2026-10-28T02:30:53.674700179Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"CVE-2026-105682","title":"Ghost: Server-Side Request Forgery in Webhook Trigger","description":"Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.","status":"published","published":"2026-10-05T19:29:22.093Z","modified":"2026-10-28T02:31:08.819086294Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-354h-gmhv-mr9c","title":"Ghost: Server-Side Request Forgery in Webhook Trigger","description":"### Impact\n\nAn SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v1.18.0 up to v6.27.0.\n\n### Patches\n\nv6.27.0 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). \n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). \n\n### References\n\nGhost thanks [0xkakash1](https://github.com/0xkakash1), [rooks00](https://github.com/rooks00), [l3tchupkt](https://github.com/l3tchupkt), [Wernerina](https://github.com/Wernerina), krn0@bugcrowdninja.com, and [Mohamed Bassia](https://github.com/0xBassia) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).","status":"published","published":"2026-10-07T16:17:57Z","modified":"2026-10-13T08:25:45.620655743Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"BIT-ghost-2026-103287","title":"Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook","description":"Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.","status":"published","published":"2026-10-09T10:45:06.587Z","modified":"2026-10-13T08:25:45.620655743Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"BIT-ghost-2026-105682","title":"Ghost: Server-Side Request Forgery in Webhook Trigger","description":"Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.","status":"published","published":"2026-10-13T06:50:35.774Z","modified":"2026-10-13T08:25:45.620655743Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}