CVE-2026-53944

CVSS Score & Metrics

Base Score

5.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N                                    

Vulnerability Description

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. This vulnerability is fixed in 6.21.1.

Vulnerability Details

Published Date

June 24, 2026

Last Modified

June 24, 2026

CWE ID

CWE-184

Source

NVD

Vendor

TryGhost

Product

Ghost

External References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-wvp2-4qqp-4h3r

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment