Executive brief
Ghost, a popular open-source publishing platform, is vulnerable to a security flaw that allows attackers to bypass internal network protections. By exploiting how the server handles web addresses, an attacker could force the Ghost server to connect to private internal systems that should not be accessible from the internet. This could lead to unauthorized access to internal services or data within a company's private network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Ghost due to a Time-of-Check Time-of-Use (TOCTOU) flaw in its outbound request handling. While Ghost implements checks to prevent connections to private IP ranges, these can be bypassed using DNS rebinding techniques. An attacker can provide a malicious domain that initially resolves to a public IP to pass the security check, but subsequently resolves to a private IP when the actual connection is made. This allows the attacker to probe or interact with internal network services (e.g., RFC1918, loopback, or link-local addresses) through features like oEmbed, webmentions, and recommendations. The issue is patched in version 6.21.1.
Affected products
- Ghost Foundation Ghost 6.0.9 to 6.21.0
Timeline
- 2026-06-10: disclosed: Initial disclosure to TryGhost/Ghost repository
- 2026-06-24: advisory: NVD publication date
- 2026-08-04: advisory: GitHub Advisory Database publication date
- 2026-08-04: patched: Fix released in version 6.21.1