low2.7
CVE-2026-105682
Ghost: Server-Side Request Forgery in Webhook Trigger
Impact
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ghost | >= 1.18.0, < 6.27.0 | 6.27.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-354h-gmhv-mr9c
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c
- https://nvd.nist.gov/vuln/detail/CVE-2026-105682
- https://github.com/TryGhost/Ghost/issues/27219
- https://github.com/TryGhost/Ghost/commit/815962dd2760e55c5dc8d0fb7fac732a7634566f
- https://github.com/TryGhost/Ghost/releases/tag/v6.27.0