CVE-2026-105682 — Ghost: Server-Side Request Forgery in Webhook Trigger
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost …
Published: 2026-10-05 · CVSS: 2.7 · CVSS 3.1
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7