CVE-2026-103287
Received Received - Intake

Server-Side Request Forgery in Ghost CMS Webhooks

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: VulnCheck

Description
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103287
EUVD
EUVD-2026-90680

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ghost ghost to 6.27.0 (exc)
tryghost ghost to 6.27.0 (exc)
tryghost ghost 6.27.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Ghost versions 1.18.0 before 6.27.0 have a server-side request forgery (SSRF) vulnerability in the webhooks feature. Staff users with privileges can exploit this to send crafted webhook requests that probe internal hosts and access internal network resources from the Ghost server.

Detection Guidance

To detect this SSRF vulnerability in Ghost, check if your Ghost instance is running a vulnerable version (1.18.0 to 6.26.x). Review webhook logs for suspicious outbound requests to internal IP ranges or unusual destinations. Use network monitoring tools to inspect traffic originating from the Ghost server.

Impact Analysis

Attackers with staff access could use this to scan internal networks, access sensitive internal services, or exfiltrate data from internal systems. This could lead to data breaches, unauthorized access to internal resources, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Update Ghost to version 6.27.0 or later to address the server-side request forgery vulnerability in the webhooks feature. Restrict staff user privileges to only those necessary for their roles to limit potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart