{"uuid": "d6e322c3-6fc5-4e0c-947d-c83af8076452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-ch52-px8q-f22j", "type": "seen", "source": "https://gist.github.com/alon710/e46f39ae43e3fffa5ce1183a133d472c", "content": "# CVE-2026-53945: CVE-2026-53945: Time-of-Check to Time-of-Use (TOCTOU) DNS Rebinding Server-Side Request Forgery in Ghost CMS\n\n> **CVSS Score:** 4.0\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53945\n\n## Summary\nGhost CMS is vulnerable to Server-Side Request Forgery (SSRF) in versions 6.0.9 through 6.21.1. Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition in its outbound fetch validation logic, an attacker can bypass IP blocklists via DNS Rebinding. This allows unauthorized interaction with private networks and local services.\n\n## TL;DR\nA DNS Rebinding vulnerability in Ghost CMS allows attackers to bypass private IP blocklists and execute SSRF requests against local networks due to a TOCTOU race condition between request validation and socket establishment.\n\n## Technical Details\n\n- **CWE ID**: CWE-367 (TOCTOU), CWE-918 (SSRF)\n- **Attack Vector**: Network (Unauthenticated SSRF)\n- **CVSS Score**: 4.0 (Medium)\n- **EPSS Score**: 0.00140 (0.14%)\n- **Exploit Status**: Proof of Concept / Technical Analysis available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS self-hosted deployments running versions 6.0.9 through 6.21.0\n- **Ghost**: >= 6.0.9, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Implement network egress filters using iptables or cloud security groups to restrict outbound connections to private subnets.\n- Ensure production deployments have NODE_ENV set to production.\n\n**Remediation Steps:**\n1. Navigate to the Ghost installation directory on your host server.\n2. Execute 'ghost update' to pull and install the latest security releases.\n3. Verify the running configuration environment by inspecting the startup logs for active development mode warnings.\n4. Configure cloud security rules to block outgoing traffic from the Ghost server targeting the metadata address 169.254.169.254.\n\n## References\n\n- [GitHub Security Advisory GHSA-ch52-px8q-f22j](https://github.com/TryGhost/Ghost/security/advisories/GHSA-ch52-px8q-f22j)\n- [NVD - CVE-2026-53945 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-53945)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53945) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T07:31:31.591410Z"}