Ghost CMS CVE-2026-105647

Exploitation requires that the Ghost instance process an attacker-supplied URL through its oembed/bookmark/favicon-fetching path - in practice reachable via the unauthenticated Webmentions feature named in the advisory. The specific technical prerequisite is winning a DNS-rebinding race against the favicon probe path, which historically used metascraper-logo-favicon's reachable-url resolver (bundling got 11) that ignored the connection-time dnsLookup IP validation Ghost installs via externalRequest. Limiting factors: the attack is BLIND (no response data returned, per the description), so it yields only internal-host reachability/probing rather than data theft; it depends on successfully timing the DNS rebind (AC:H); it requires an internal network with reachable hosts worth probing; and it is fully remediated in 6.65.0 for versions 6.54.1 through 6.64.x.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N, base 4.0) is internally consistent with the description: an unauthenticated attacker can reach the network, but AC:H reflects the race-condition nature (CWE-367 TOCTOU, consistent with the DNS-rebinding mechanism shown in the patch), S:C reflects that the impact crosses into the Ghost server's internal network, and C:L/I:N/A:N reflect that this is a BLIND SSRF - the description explicitly states 'a successful attack would not result in any response data being returned.' No EPSS score, SSVC decision, KEV listing, or POC was provided in the input. There is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of high attack complexity (winning a DNS-rebinding race), blind-only impact (no exfiltration of response bodies), and limited technical impact means this is a defense-in-depth hardening fix rather than an urgent threat. The C:L rating is arguably generous given that no data is returned - realistic impact is limited to probing reachability/existence of internal hosts via timing, not reading their contents.

An unauthenticated attacker submits a Webmention or a URL that Ghost processes via its oembed/favicon-fetching service, pointing at a domain the attacker controls. Using DNS rebinding, the attacker races the resolver so Ghost's outbound fetch lands on an internal RFC1918 address, causing the server to issue limited HTTP requests against hosts in its internal network. Because no response body is returned to the attacker, exploitation is blind and reconnaissance-oriented; no public exploit code was identified in the provided data.