Node.js CMS Ghost Vulnerability Affects Functionality for Unauthenticated Users
CVE-2026-105648

4MEDIUM

Key Information:

Vendor

Tryghost

Status
Ghost
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105648?

A validation issue in Ghost, a popular Node.js content management system, affects versions from 6.0.9 to 6.65.0. This vulnerability allows unauthenticated users to exploit certain functionalities, including Webmentions, enabling them to perform limited HTTP requests to the Ghost server's internal network under specific network configurations. While no data response is returned from these requests, the potential for internal probing presents a security concern. The issue has been addressed in version 6.65.0, encouraging users to update promptly.

Affected Version(s)

Ghost >= 6.0.9, < 6.65.0

References

https://github.com/TryGhost/Ghost/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/TryGhost/Ghost/pull/30917
x_refsource_MISC
https://github.com/TryGhost/Ghost/commit/20d3f792bf4a7c34...
x_refsource_MISC

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.