https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T02:07:57.339491+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-103291 CVE-2026-103291 — Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch 2026-10-03T02:07:57.477021+00:00

Affected: TryGhost Ghost

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network endpoints to access metadata services and internal resources unavailable from the public internet.