CVE-2026-103287: Tryghost Ghost

Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.

Affected products

• Tryghost Ghost: from 1.18.0, before 6.27.0 (fixed in 6.27.0)

Published 2026-10-01. Last modified 2026-10-06.