{"id":"EUVD-2026-92754","enisaUuid":"4480d94f-d556-3d7f-b7c2-b851e6189f59","description":"Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server\u0027s internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.","datePublished":"Oct 5, 2026, 7:01:20 PM","dateUpdated":"Oct 5, 2026, 7:52:13 PM","baseScore":4.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9\nhttps://github.com/TryGhost/Ghost/pull/30918\nhttps://github.com/TryGhost/Ghost/commit/3f8594eb53de883ac017545c358f59039cb152de\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.65.0\n","aliases":"CVE-2026-105647\nGHSA-322m-ff4g-9vx9\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"1ae154d3-6737-380e-9a10-d966ba45df46","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"6.54.1, \u003c 6.65.0"}],"enisaIdVendor":[{"id":"a7cb1ff8-974d-3e22-8260-6f6f9b5ecec7","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"11ffe287-c034-3083-bfe9-25200be748d5","vulnerability":{"id":"CVE-2026-105647","description":"Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server\u0027s internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.","datePublished":"Oct 5, 2026, 7:01:20 PM","dateUpdated":"Oct 5, 2026, 7:52:13 PM","status":"PUBLISHED","baseScore":4.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9\nhttps://github.com/TryGhost/Ghost/pull/30918\nhttps://github.com/TryGhost/Ghost/commit/3f8594eb53de883ac017545c358f59039cb152de\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.65.0\n","enisa_id":"EUVD-2026-92754\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 8, 2026, 7:16:13 AM","vulnerabilityProduct":[{"id":"68b63d3a-d9f7-34e6-bf86-2d94ccb5c3ca","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"6.54.1, \u003c 6.65.0"}],"vulnerabilityVendor":[{"id":"8ed24998-5e50-35c4-9fbc-97dc7d3231fe","vendor":{"name":"TryGhost"}}]}},{"id":"49f0839a-3f17-384d-8691-fcd0c126c0dd","vulnerability":{"id":"GHSA-322m-ff4g-9vx9","description":"Ghost: Server-Side Request Forgery in Bookmark Fetching","datePublished":"Oct 7, 2026, 8:35:32 PM","dateUpdated":"Oct 7, 2026, 8:35:32 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105647\nhttps://github.com/TryGhost/Ghost/pull/30918\nhttps://github.com/TryGhost/Ghost/commit/3f8594eb53de883ac017545c358f59039cb152de\nhttps://github.com/TryGhost/Ghost\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.65.0\n","enisa_id":"EUVD-2026-92754\n","aliases":"GHSA-322m-ff4g-9vx9\nCVE-2026-105647\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}