CVE-2026-103287: Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.27.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs staff-level privileges in Ghost. The issue is exploitable over the network and does not require user interaction.
What systems are exposed through the vulnerability?
The affected webhook feature can be used to send requests from the Ghost server to internal network resources. This allows a staff user to probe hosts reachable from the Ghost server.
Which versions need remediation?
Ghost versions from 1.18.0 up to, but not including, 6.27.0 are affected. Upgrading to 6.27.0 or later addresses the affected version range.