GHSA-wvp2-4qqp-4h3r

Source

https://github.com/advisories/GHSA-wvp2-4qqp-4h3r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-wvp2-4qqp-4h3r/GHSA-wvp2-4qqp-4h3r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wvp2-4qqp-4h3r

Aliases

Published

2026-08-04T21:13:16Z

Modified

2026-08-04T21:30:19Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator

Summary

Ghost: Private IP filtering bypass to make server-side requests to internal services

Details

Impact

When making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address.

Vulnerable versions

This vulnerability is present in Ghost from v6.0.9 up to v6.21.0.

Patches

v6.21.1 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

References

Ghost thanks l3tchupkt for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email us at security@ghost.org.

Database specific

{
    "cwe_ids":  [
        "CWE-184",
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-04T21:13:16Z",
    "nvd_published_at":  "2026-06-24T19:17:11Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / ghost

Package

Name: ghost; View open source insights on deps.dev
Purl: pkg:npm/ghost

Affected ranges

Type: SEMVER
Events: Introduced

6.0.9

Fixed

6.21.1

Database specific

last_known_affected_version_range

"<= 6.21.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-wvp2-4qqp-4h3r/GHSA-wvp2-4qqp-4h3r.json"