PT-2026-52069

CVE-2026-53945

Published

2026-06-24

Updated

2026-08-04

Description by

CVSS 3.1

4.0

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ghost versions 6.0.9 through 6.21.0

Description Ghost is a Node.js content management system. A flaw in the private-IP check for outbound HTTP requests allows a bypass via DNS rebinding. DNS rebinding is a technique that tricks a browser or server into accessing a private network address by changing the DNS record of a domain after the initial check. This allows an attacker to force the server to reach hosts on internal networks through features that perform external fetches.

Recommendations Update to version 6.21.1.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Related identifiers

CVE-2026-53945