CVE-2026-105648

Name of the Vulnerable Software and Affected Versions Ghost versions 6.0.9 through 6.64.0

Description A validation issue in the Webmentions functionality allows an unauthenticated user to perform limited HTTP requests to hosts within the internal network of the Ghost server on certain network configurations. This type of flaw, where a server is coerced into making requests to an internal resource, is known as Server-Side Request Forgery (SSRF). In this case, a successful attack does not return any response data to the attacker.

Recommendations Update to version 6.65.0.