CVE-2026-103287 Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
Staff users can exploit a webhook vulnerability in Ghost to perform Server-Side Request Forgery and access internal network resources.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103287?
CVE-2026-103287 is a medium-severity server-side request forgery vulnerability in TryGhost Ghost, published on 1 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.
Weakness: CWE-918
Which versions are affected by CVE-2026-103287?
How do I fix CVE-2026-103287?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-103287 being exploited?
There is no known exploitation of CVE-2026-103287 in the wild and no public exploit code.
Sources
Also known as GHSA-qhr2-wq77-6fjw.