CVE-2026-105682

low

Description

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c

https://github.com/TryGhost/Ghost/releases/tag/v6.27.0

https://github.com/TryGhost/Ghost/issues/27219

https://github.com/TryGhost/Ghost/commit/815962dd2760e55c5dc8d0fb7fac732a7634566f

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92773

Details

Source: Mitre, NVD

Published: 2026-10-05

Updated: 2026-10-06

Risk Information

CVSS v2

Base Score: 3.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:P/I:N/A:N

Severity: Low

CVSS v3

Base Score: 2.7

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Severity: Low

EPSS

EPSS: 0.0024

Detections

Analytics