https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-08T16:00:14.788191+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-105648 fkie_cve-2026-105648 2026-10-08T16:00:14.819602+00:00

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

 https://db.gcve.eu/vuln/ghsa-r7f2-6fj8-6fg2 GHSA-r7f2-6fj8-6fg2 — Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses 2026-10-08T16:00:14.819691+00:00

Affected: npm: ghost

### Impact

A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned.

### Vulnerable versions

This vulnerability is present in Ghost from v6.0.9 up to v6.64.0.

### Patches

v6.65.0 contains a fix for this issue.

### How to update

For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).

If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).

### References

Ghost thanks [Nhat Anh Vu](https://github.com/nhattanhh) for disclosing this vulnerability responsibly.

### For more information

If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).