Dashboard / CVE-2026-53945

CVE-2026-53945

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 58/100
Published: 2026-06-24 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Changed
C: None
I: Low
A: None

Description

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. This vulnerability is fixed in 6.21.1.

Weakness Classification (2)

References & Advisories (1)

Bug Bounty Relevance

58 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

4.0 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

EPSS — Exploitation Probability

0.21%
Raw Score 0.002140
Percentile 11.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00214
2026-10-28
0.00214

Intelligence Sources

nvd ref →

External Links