CVE-2026-105647— Ghost: Server-Side Request Forgery in Bookmark Fetching
Quick assessment
Affected
TryGhost Ghost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghost 是一个基于 Node.js 的内容管理系统（CMS）。在版本 6.54.1 至 6.65.0 之间，存在一个验证缺陷，使未认证的用户能够滥用某些功能（例如 Webmentions），从而对 Ghost 服务器内部网络中的主机发起有限的 HTTP 请求。成功的攻击不会导致任何响应数据被返回。该问题已在版本 6.65.0 中修复。
Possible ATT&CK Techniques 1 AI
T1598.004 · Spearphishing Voice
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105647
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghost: Server-Side Request Forgery in Bookmark Fetching
Source: CVE Program / CVE List V5
Vulnerability Description
Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-105647
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105647
请登录查看更多情报信息。
Other References for CVE-2026-105647 (4)
-
https://github.com/TryGhost/Ghost/pull/30918 x_refsource_MISC
-
https://github.com/TryGhost/Ghost/releases/tag/v6.65.0 x_refsource_MISC
-
https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9 x_refsource_CONFIRM
Same Patch Batch · TryGhost · 2026-10-05 · 20 CVEs total
| CVE-2026-105642 | 8.8 HIGH | Ghost: Remote Code Execution via Bookmark Card Images |
| CVE-2026-105650 | 8.1 HIGH | Ghost: Stored XSS via oEmbed Photo Responses |
| CVE-2026-105675 | 7.5 HIGH | Ghost: Invite Token Disclosure in Ghost Admin API |
| CVE-2026-105679 | 7.3 HIGH | Ghost: Stored XSS via File Uploads on Local Storage |
| CVE-2026-105643 | 7.3 HIGH | Ghost: Stored XSS via Embed Card Previews |
| CVE-2026-105651 | 7.3 HIGH | Ghost: Stored XSS via Bookmark Card Images |
| CVE-2026-105649 | 7.3 HIGH | Ghost: Stored XSS via SVG Uploads Bypassing Sanitization |
| CVE-2026-105677 | 7.2 HIGH | Ghost: Remote Code Execution via Theme Translation Files |
| CVE-2026-105644 | 6.8 MEDIUM | Ghost: Stored XSS via SVG Files in Content Imports |
| CVE-2026-105681 | 6.5 MEDIUM | Ghost: Authorization Bypass in Comments Feature |
| CVE-2026-105680 | 6.5 MEDIUM | Ghost: Authorization Issue Allowed Author Role to Delete any Post |
| CVE-2026-105646 | 4.9 MEDIUM | Ghost: Regular Expression Denial of Service in Content Import |
| CVE-2026-105676 | 4.9 MEDIUM | Ghost: Path Traversal via Locale Setting |
| CVE-2026-105645 | 4.9 MEDIUM | Ghost: Regular Expression Denial of Service in External Media Inliner |
| CVE-2026-105678 | 4.3 MEDIUM | Ghost: Editors Could Promote Staff Users to Their Own Role |
| CVE-2026-105648 | 4.0 MEDIUM | Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses |
| CVE-2026-105683 | 3.8 LOW | Ghost: Path Traversal Vulnerability in Ghost ImageSize Service |
| CVE-2026-105652 | 3.1 LOW | Ghost: Password Hash Ordering Disclosure in Ghost Admin API |
| CVE-2026-105682 | 2.7 LOW | Ghost: Server-Side Request Forgery in Webhook Trigger |
IV. Related Vulnerabilities
Same product: Ghost
-
CVE-2026-105683
Ghost: Path Traversal Vulnerability in Ghost ImageSize Servi -
CVE-2026-105682
Ghost: Server-Side Request Forgery in Webhook Trigger -
CVE-2026-105681
Ghost: Authorization Bypass in Comments Feature -
CVE-2026-105680
Ghost: Authorization Issue Allowed Author Role to Delete any -
CVE-2026-105679
Ghost: Stored XSS via File Uploads on Local Storage
Same vendor: TryGhost
-
CVE-2026-105683
Ghost: Path Traversal Vulnerability in Ghost ImageSize Servi -
CVE-2026-105682
Ghost: Server-Side Request Forgery in Webhook Trigger -
CVE-2026-105681
Ghost: Authorization Bypass in Comments Feature -
CVE-2026-105680
Ghost: Authorization Issue Allowed Author Role to Delete any -
CVE-2026-105679
Ghost: Stored XSS via File Uploads on Local Storage
Same weakness: CWE-367
-
CVE-2026-77804
Time-of-check Time-of-use (TOCTOU) Race Condition in Root Ce -
CVE-2026-105163
crossplane crossplane-runtime ImageConfig client.go Get toct -
CVE-2026-105130
LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per -
CVE-2026-104474
OpenLiteSpeed before 1.9.3 Local Privilege Escalation via ls -
CVE-2026-47497
NVIDIA vGPU GSP追踪组件越界访问漏洞
V. Comments for CVE-2026-105647
No comments yet