cve.bz

CVE-2026-105682

2.7 lowEPSS 0.2%

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.

CVSS 3.1
2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-25)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-354h-gmhv-mr9cnpmghost>=1.18.0 <6.27.06.27.0

References

Check your stackJSON