{"vulnerability": "CVE-2026-105647", "sightings": [{"uuid": "ce9f7edc-d7c9-4805-8cb9-b0f44d50953c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105647", "type": "seen", "source": "https://gist.github.com/alon710/e9c5321f79c46f7c54f00ee758f049f3", "content": "# CVE-2026-105647: CVE-2026-105647: Server-Side Request Forgery via Favicon Probing in Ghost CMS\n\n> **CVSS Score:** 4.0\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105647\n\n## Summary\nAn unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Ghost CMS from version 6.54.1 to 6.65.0. The vulnerability stems from a validation bypass in the favicon resolution logic within the bookmark-fetching subsystem, which allows remote, unauthenticated attackers to trigger arbitrary HTTP requests to the local host and internal networks. This bypass circumvents the custom DNS-level IP blocklist controls configured globally in the application.\n\n## TL;DR\nGhost CMS versions 6.54.1 through 6.64.0 are vulnerable to unauthenticated blind SSRF due to a validation bypass in the favicon resolution flow. Attackers can leverage this to make HTTP requests targeting private and loopback networks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 / CWE-367\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.0 (Medium)\n- **Exploit Status**: PoC / Analytical\n- **CISA KEV Status**: Not Listed\n- **Impact**: Low Confidentiality (Blind SSRF)\n\n## Affected Systems\n\n- Ghost Content Management System (CMS)\n- **Ghost**: >= 6.54.1, < 6.65.0 (Fixed in: `6.65.0`)\n\n## Mitigation\n\n- Upgrade Ghost to version 6.65.0 or later to apply the official security patch.\n- Enforce outbound firewall boundaries at the operating system or cloud configuration layer.\n- Proxy outbound application traffic through a dedicated forward proxy with restricted destination ACLs.\n\n**Remediation Steps:**\n1. Step 1: Inspect the running Ghost application version via the admin panel or package manifest.\n2. Step 2: Execute command 'npm install ghost@6.65.0' or use the CLI updater 'ghost update' to upgrade the instance.\n3. Step 3: Establish local host egress rules limiting outbound TCP requests to valid public subnets.\n\n## References\n\n- [GitHub Security Advisory GHSA-322m-ff4g-9vx9](https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9)\n- [NVD - CVE-2026-105647 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-105647)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105647) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T16:30:28.000000Z"}]}