CVE-2026-103287

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103287
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103287.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103287
Aliases
  • GHSA-354h-gmhv-mr9c
Published
2026-10-01T10:42:21Z
Modified
2026-10-03T03:45:47Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
Details

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103287.json"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
7545e67f2cb303df2a45c0ffe3c6a3b260eef542
Fixed
2daa6eba775c961ca41f2732b622d9deb86a39ee
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.18.0"
        },
        {
            "fixed":  "6.27.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103287.json"