cve.bz

CVE-2026-103287

5.1 mediumEPSS 0.2%

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.

CVSS 4.0
5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-25)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-354h-gmhv-mr9cnpmghost>=1.18.0 <6.27.06.27.0

References

Check your stackJSON