CVE-2026-105648
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
CVSS Score
4.0
EPSS Score
0.0%
EPSS Percentile
0th
Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.
| CWE | CWE-184 CWE-918 |
| Vendor | tryghost |
| Product | ghost |
| Published | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for tryghost ghost
Be the first to know when new medium vulnerabilities affecting tryghost ghost are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
TryGhost / Ghost
>= 6.0.9, < 6.65.0
References
github.com: https://github.com/TryGhost/Ghost/security/advisories/GHSA-r7f2-6fj8-6fg2 github.com: https://github.com/TryGhost/Ghost/pull/30917 github.com: https://github.com/TryGhost/Ghost/commit/20d3f792bf4a7c349ee56b746a067550d8684ff5 github.com: https://github.com/TryGhost/Ghost/releases/tag/v6.65.0