{"vulnerability": "ghsa-wvp2-4qqp-4h3r", "sightings": [{"uuid": "5f60791f-04d1-4d6b-849f-099ea65d7585", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-wvp2-4qqp-4h3r", "type": "seen", "source": "https://gist.github.com/alon710/489e9ca002ac3cb955fb509b828c43ec", "content": "# CVE-2026-53944: CVE-2026-53944: Server-Side Request Forgery Private IP Filtering Bypass in Ghost CMS\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53944\n\n## Summary\nA Server-Side Request Forgery (SSRF) vulnerability exists in the Ghost content management system from version 6.0.9 up to, but not including, 6.21.1. The flaw resides in the 'request-external.js' module, where the IP address validation blocklist fails to account for fully expanded IPv4-mapped IPv6 formats. This allows unauthenticated remote attackers to bypass the private IP filter and initiate unauthorized connections to loopback services, internal subnets, or cloud instance metadata endpoints.\n\n## TL;DR\nGhost CMS versions 6.0.9 through 6.21.0 fail to validate expanded IPv4-mapped IPv6 addresses, enabling remote attackers to bypass SSRF protections and access internal network resources or cloud metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 5.8\n- **EPSS Score**: 0.00197\n- **Impact**: Bypass of network sanitization boundary to target local/private endpoints\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS installations running version 6.0.9 up to 6.21.0\n- **Ghost**: >= 6.0.9, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost instances to version 6.21.1 or later to apply the official patch.\n- Configure host-based firewall rules (iptables/nftables) to drop outbound traffic from the Ghost process to private subnets and local loopback.\n- Deploy WAF rules to detect and block incoming request payloads that contain expanded IPv4-mapped IPv6 addresses.\n\n**Remediation Steps:**\n1. For standard Ghost CLI installations, run 'ghost update' to update to the latest patched version.\n2. For Docker-based deployments, pull the latest image tag using 'docker pull ghost:6.21.1' or update the docker-compose configuration.\n3. In AWS or other cloud environments, enforce IMDSv2 with a hop limit of 1 to prevent metadata access via container SSRF.\n\n## References\n\n- [GitHub Security Advisory GHSA-wvp2-4qqp-4h3r](https://github.com/TryGhost/Ghost/security/advisories/GHSA-wvp2-4qqp-4h3r)\n- [Ghost Version 6.21.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [NVD Record for CVE-2026-53944](https://nvd.nist.gov/vuln/detail/CVE-2026-53944)\n- [CVE.org Record for CVE-2026-53944](https://www.cve.org/CVERecord?id=CVE-2026-53944)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53944) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T08:32:27.907632Z"}]}