CVE-2026-103287: Ghost Package Server-Side Request Forgery Vulnerability
Summary
CVE-2026-103287: Ghost: Server-Side Request Forgery in Webhook Trigger. Affects ghost versions >= 1.18.0, < 6.27.0. Fixed in 6.27.0. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2026-103287 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghost is a popular open-source Node.js content management system designed for professional publishing. It provides a user-friendly interface for creating and managing content, with features such as customizable themes, built-in SEO tools, and support for multiple users. However, versions 1.18.0 to 6.27.0 of Ghost contain a vulnerability in the webhooks feature that allows staff users to exploit server-side request forgery (SSRF), potentially probing internal hosts from the Ghost server.
Vulnerability Detail
The SSRF vulnerability in Ghost arises from improper validation of user input in the webhooks feature. This flaw allows authenticated staff users to send crafted requests to internal services, which could lead to unauthorized access to sensitive data or services within the internal network. The vulnerability affects versions 1.18.0 through 6.27.0, and it is crucial for users to understand the risks associated with this issue, as it can lead to significant security breaches.
How To Fix
Minimum fixed version
6.27.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the webhooks feature by limiting the permissions of staff users or disabling the webhooks functionality until the package is updated. This can be done by adjusting user roles in the Ghost admin settings.
Conclusion
The SSRF vulnerability in Ghost versions 1.18.0 to 6.27.0 poses a significant risk to users, allowing authenticated staff to probe internal hosts. It is essential to update to version 6.27.0 or later to mitigate this risk. Utilizing tools like Vulert can enhance your security posture by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for ghost →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data exposure.
You can check if your Ghost installation is affected by using tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your application without needing to sign up.
Failing to address this vulnerability could allow malicious users to access sensitive internal services, leading to data breaches, unauthorized actions, and potential compromise of the entire system.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed. Keeping your software up to date helps protect against known threats.
Yes, Vulert can monitor various open-source packages by analyzing the manifest files like package-lock.json, providing real-time alerts for vulnerabilities across your software stack.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
