What is GHSA-qhr2-wq77-6fjw?

GHSA-qhr2-wq77-6fjw is a security advisory published by GitHub Security Advisories with Medium severity. Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the...

Which CVE IDs does GHSA-qhr2-wq77-6fjw cover?

GHSA-qhr2-wq77-6fjw covers the following CVE IDs: CVE-2026-103287. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qhr2-wq77-6fjw?

GHSA-qhr2-wq77-6fjw has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

GHSA-qhr2-wq77-6fjwMediumCVSS 2.7

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the...

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-103287 →

📋 Description

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.

🔗 References (4)

https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c
https://nvd.nist.gov/vuln/detail/CVE-2026-103287
https://www.vulncheck.com/advisories/ghost-1.18.0-before-6.27.0-server-side-request-forgery-via-webhook
https://github.com/advisories/GHSA-qhr2-wq77-6fjw