Executive brief
Ghost is a popular open-source content management system and blogging platform. A security flaw in how the software handles external links (Webmentions) could allow an unauthorized person to probe the server's internal network. While an attacker cannot see the data returned from these internal requests, they could potentially identify active services or internal systems that should not be reachable from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Ghost due to insufficient validation of URLs in features such as Webmentions. An unauthenticated remote attacker can exploit this by providing a malicious URL, causing the Ghost server to initiate an HTTP request to internal network hosts. The attack complexity is rated high because the vulnerability only allows for 'blind' SSRF, meaning the attacker cannot view the response body from the internal requests. The issue is present in versions 6.26.0 through 6.54.0 and is fixed in version 6.54.1.
Affected products
- Ghost Foundation Ghost >= 6.26.0, < 6.54.1
Timeline
- 2026-07-30: disclosed: Initial disclosure date
- 2026-08-05: advisory: GitHub Advisory published
- 2026-08-05: patched: Version 6.54.1 released