CVE-2026-105648: Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-184

Description

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

Affected products

TryGhost Ghost: from 6.0.9, < 6.65.0

References

https://github.com/TryGhost/Ghost/commit/20d3f792bf4a7c349ee56b746a067550d8684ff5
https://github.com/TryGhost/Ghost/pull/30917
https://github.com/TryGhost/Ghost/releases/tag/v6.65.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-r7f2-6fj8-6fg2

Get alerted when CVE-2026-105648 or the next vulnerability affects your stack