CVE-2026-103291: Tryghost Ghost

Medium severity, CVSS 6.4. EPSS: 0.1% chance of exploitation in the next 30 days.

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network endpoints to access metadata services and internal resources unavailable from the public internet.

Affected products

• Tryghost Ghost: from 3.20.2, before 6.51.0 (fixed in 6.51.0)

Published 2026-10-01. Last modified 2026-10-06.