CVE-2026-105648

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105648
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105648.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105648
Aliases
  • GHSA-r7f2-6fj8-6fg2
Published
2026-10-05T19:03:16Z
Modified
2026-10-06T10:45:45Z
Severity
  • 4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Details

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-184",
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105648.json"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
c076dcc64d4af99dca0ecc380d5f4df04fc2a0fd
Fixed
8d5bded685b9b2019d47e298dc4594a1c4049557
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "6.0.9"
        },
        {
            "fixed":  "6.65.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105648.json"