Ghost, a Node.js based CMS, contains a Server‑Side Request Forgery flaw in its webhook handling feature that is present from version 1.18.0 through 6.26.x. The vulnerability permits an authenticated staff user to configure a webhook that causes the Ghost server to resolve and request arbitrary URLs, exposing details about internal network services. While the flaw does not enable direct code execution on the Ghost host, it can provide an attacker with valuable visibility into internal infrastructure.

The issue affects all Ghost installations from version 1.18.0 up to, but not including, 6.27.0. Any deployment in this range that allows staff members to create or edit webhooks is vulnerable. The fix is incorporated in Ghost 6.27.0, which removes the vulnerable code path.

The CVSS base score of 2.7 indicates low to moderate severity. No EPSS score is available, so the frequency of exploitation attempts is unclear. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no known active exploitation in the wild. Attackers require authenticated staff credentials and the ability to create a webhook, making the attack vector internal; the impact is limited to the discovery of internal hosts.