Validation Issue in Ghost CMS Allows Unauthorized HTTP Requests
CVE-2026-105647

4MEDIUM

Key Information:

Vendor

Tryghost

Status
Ghost
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105647?

Ghost CMS, a popular Node.js content management system, has a validation flaw affecting versions between 6.54.1 and 6.65.0. The issue allows an unauthenticated user to exploit functionalities like Webmentions, which can lead to unauthorized and limited HTTP requests being sent to servers within the Ghost server's internal network. Although this vulnerability does not expose any response data, it poses a potential risk for internal network security. The vulnerability has been addressed in the latest release, 6.65.0.

Affected Version(s)

Ghost >= 6.54.1, < 6.65.0

References

https://github.com/TryGhost/Ghost/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/TryGhost/Ghost/pull/30918
x_refsource_MISC
https://github.com/TryGhost/Ghost/commit/3f8594eb53de883a...
x_refsource_MISC

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.