{"id":"CVE-2026-103287","state":"PUBLISHED","title":"Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook","description":"Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.","publishedAt":"2026-10-01T10:42:21.818Z","updatedAt":"2026-10-06T01:42:26.590Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["TryGhost Ghost"],"affected":[{"vendor":"TryGhost","product":"Ghost","packageURL":"pkg:npm/ghost","defaultStatus":"unaffected","versions":[{"version":"1.18.0","status":"affected","lessThan":"6.27.0","versionType":"semver"}]}],"references":["https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c","https://www.vulncheck.com/advisories/ghost-1.18.0-before-6.27.0-server-side-request-forgery-via-webhook"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/103xxx/CVE-2026-103287.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-103287","state":"PUBLISHED","datePublished":"2026-10-01T10:42:21.818Z","dateUpdated":"2026-10-06T01:42:26.590Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-30T10:59:26.443Z"},"containers":{"cna":{"title":"Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook","descriptions":[{"lang":"en","value":"Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server."}],"affected":[{"vendor":"TryGhost","product":"Ghost","packageURL":"pkg:npm/ghost","defaultStatus":"unaffected","versions":[{"version":"1.18.0","status":"affected","lessThan":"6.27.0","versionType":"semver"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-354h-gmhv-mr9c)"},{"url":"https://www.vulncheck.com/advisories/ghost-1.18.0-before-6.27.0-server-side-request-forgery-via-webhook","name":"VulnCheck Advisory: Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":5.1,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","lang":"en","description":"Server-Side Request Forgery (SSRF)","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-01T10:42:21.818Z"},"datePublic":"2026-08-11T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ghost:ghost:*:*:*:*:*:*:*:*","versionStartIncluding":"1.18.0","versionEndExcluding":"6.27.0"}]}]}],"credits":[{"lang":"en","value":"0xkakash1","type":"reporter"},{"lang":"en","value":"0xBassia","type":"reporter"},{"lang":"en","value":"l3tchupkt","type":"reporter"},{"lang":"en","value":"rooks00","type":"reporter"},{"lang":"en","value":"Wernerina","type":"reporter"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-06T01:42:14.919506Z","id":"CVE-2026-103287","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-06T01:42:26.590Z"}}]}}}