p PatchFirst

CVE-2026-103287

CVE-2026-103287 · Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.

CVSS 5.1 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • ≥ 1.18.0, < 6.27.0: Affected (semver)

    Update to 6.27.0

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 1.18.0, < 6.27.0

    Update to 6.27.0

Original sources

Check your server →