CVE-2026-105647: Ghost Package Server-Side Request Forgery Vulnerability in Bookmark Fetching
Summary
CVE-2026-105647: Ghost: Server-Side Request Forgery in Bookmark Fetching. Affects ghost versions >= 6.54.1, < 6.65.0. Fixed in 6.65.0. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-105647 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It offers a user-friendly interface, customizable themes, and various integrations for web publishing. However, like many web applications, it can be susceptible to security vulnerabilities, including server-side request forgery (SSRF), which can compromise internal network security.
Vulnerability Detail
The vulnerability identified as CVE-2026-105647 is a server-side request forgery (SSRF) issue in the Ghost package. This flaw arises from inadequate validation, allowing unauthenticated users to exploit certain functionalities, such as Webmentions, to make limited HTTP requests to hosts within the Ghost server's internal network. Although a successful attack does not return any response data, it poses a risk of exposing internal services to unauthorized access and potential exploitation.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.65.0
This is the first release that contains the fix.
npm install ghost@6.65.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The CVE-2026-105647 vulnerability in the Ghost package poses a moderate risk due to its potential for server-side request forgery. Users are strongly encouraged to update to version 6.65.0 or later to protect their installations from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-105647 is a server-side request forgery (SSRF) vulnerability in the Ghost package that allows unauthenticated users to make limited HTTP requests to internal network hosts.
Ghost versions from 6.54.1 up to 6.64.0 are affected by this vulnerability.
You can check your Ghost installation against this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version (6.65.0 or later) to mitigate the risk.
The vulnerability was disclosed responsibly by Nhat Anh Vu.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
