CVE-2026-105682

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-105682

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105682.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-105682

Aliases

Published

2026-10-05T19:29:22Z

Modified

2026-10-08T02:30:56Z

Severity

2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Ghost: Server-Side Request Forgery in Webhook Trigger

Details

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105682.json"
}

References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type

GIT

Repo

https://github.com/tryghost/ghost

Events

Introduced

7545e67f2cb303df2a45c0ffe3c6a3b260eef542

Fixed

815962dd2760e55c5dc8d0fb7fac732a7634566f

Fixed

2daa6eba775c961ca41f2732b622d9deb86a39ee

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.18.0"
        },
        {
            "fixed": "6.27.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105682.json"