A validation flaw in Ghost’s Webmentions functionality allows an unauthenticated user to issue HTTP requests to hosts on the internal network of the Ghost server, provided the server’s network configuration permits such traffic. The attacker cannot obtain any response data from those internal hosts, so the direct impact is limited to the ability to probe the presence of services or perform a partial port‑scanning exercise. The weakness is categorized as CWE-184 (Partial Comparison) and CWE-918 (Remote Function Execution).

TryGhost Ghost versions 6.0.9 through 6.65.0 are affected because they contain the buggy Webmentions validation logic. All other Ghost releases prior to 6.0.9 and versions 6.65.0 and later are not vulnerable.

The CVSS score of 4.0 indicates moderate risk, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. An attacker would exploit the flaw by sending crafted Webmention requests to the Ghost instance. Successful exploitation requires network connectivity to the internal hosts from the Ghost server and an unauthenticated session, assets typically outside the external attack surface. Overall, the likelihood of exploitation is low to moderate, and the potential impact is restricted to internal network probing.