CVE-2026-105648
Received Received - Intake

Ghost CMS Internal Network Request Validation Bypass

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-06
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105648
EUVD
EUVD-2026-92755

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TryGhost Ghost >= 6.0.9, < 6.65.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Ghost, a Node.js content management system, between versions 6.0.9 and 6.65.0. It allows unauthenticated users to make limited HTTP requests to internal network hosts on certain network configurations by bypassing private IP filtering using IPv6 transition addresses. The attack does not return any response data.

Detection Guidance

Check Ghost CMS version with: npm list ghost. If version is between 6.0.9 and 6.64.0, the system is vulnerable. Monitor network logs for unusual outbound requests to internal IPs from Ghost processes.

Impact Analysis

An attacker could exploit this to send requests to internal systems, potentially probing or interacting with services not intended for external access. While no data is returned, the requests themselves may trigger unintended actions or reveal network structure. Systems running Ghost versions 6.0.9 to 6.64.0 are affected.

Compliance Impact

This vulnerability could lead to unauthorized network probing or interaction with internal systems, potentially violating data protection and access control requirements under GDPR, HIPAA, or other regulations. It may indicate insufficient network segmentation or access controls, increasing compliance risks.

Mitigation Strategies

Upgrade Ghost CMS to version 6.65.0 or later immediately. If immediate upgrade is not possible, restrict outbound network access for the Ghost process to prevent internal network requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart