CVE-2026-105682

2.7 LOWpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-918

Public exploit & PoC references

https://github.com/TryGhost/Ghost/commit/815962dd2760e55c5dc8d0fb7fac732a7634566f
https://github.com/TryGhost/Ghost/issues/27219
https://github.com/TryGhost/Ghost/releases/tag/v6.27.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c

All references

https://github.com/TryGhost/Ghost/commit/815962dd2760e55c5dc8d0fb7fac732a7634566f
https://github.com/TryGhost/Ghost/issues/27219
https://github.com/TryGhost/Ghost/releases/tag/v6.27.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2020-37278PoC
HIGHCVE-2023-54402PoC
MEDIUMCVE-2024-34319
UNSCOREDCVE-2026-0311
LOWCVE-2026-100104
MEDIUMCVE-2026-100251
MEDIUMCVE-2026-100257
MEDIUMCVE-2026-100279

Related by shared AI tags and CWE weakness class. Browse the full archive.