cyfenced.com →

[ CVE-2026-105647 · Published 5 Oct 2026 ]

Ghost: Server-Side Request Forgery in Bookmark Fetching

CVSS 4.0 EPSS <1%Fix available

[ Description ]Official description

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

[ Fixes ]Fixes and patches

  • ghost 6.65.0Fixed version · GitHub Advisories · npm package ghost: upgrade to 6.65.0 or later (affected >= 6.54.1, < 6.65.0)

[ Packages ]Affected open-source packages

[ References ]References