DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-53944: CVE-2026-53944: Server-Side Request Forgery Private IP Filtering Bypass in Ghost CMS

#security #cve #cybersecurity

CVE-2026-53944: Server-Side Request Forgery Private IP Filtering Bypass in Ghost CMS

Vulnerability ID: CVE-2026-53944
CVSS Score: 5.8
Published: 2026-08-04

A Server-Side Request Forgery (SSRF) vulnerability exists in the Ghost content management system from version 6.0.9 up to, but not including, 6.21.1. The flaw resides in the 'request-external.js' module, where the IP address validation blocklist fails to account for fully expanded IPv4-mapped IPv6 formats. This allows unauthenticated remote attackers to bypass the private IP filter and initiate unauthorized connections to loopback services, internal subnets, or cloud instance metadata endpoints.

TL;DR

Ghost CMS versions 6.0.9 through 6.21.0 fail to validate expanded IPv4-mapped IPv6 addresses, enabling remote attackers to bypass SSRF protections and access internal network resources or cloud metadata.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918 (Server-Side Request Forgery)
  • Attack Vector: Network
  • CVSS v3.1: 5.8
  • EPSS Score: 0.00197
  • Impact: Bypass of network sanitization boundary to target local/private endpoints
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • Ghost CMS installations running version 6.0.9 up to 6.21.0
  • Ghost: >= 6.0.9, < 6.21.1 (Fixed in: 6.21.1)

Code Analysis

Commit: 9b7f221

Fix private IP filter bypass with expanded IPv4-mapped IPv6 addresses

@@ -139,6 +139,23 @@ function isPrivateIp(addr) {
         if (/^fe[89ab][0-9a-f]:/i.test(normalized6)) {
             return true;
         }
+        // Re-check for IPv4-mapped IPv6 after normalization
+        // Handles expanded forms like 0:0:0:0:0:ffff:127.0.0.1 which normalize to ::ffff:...
+        const v4DottedNorm = normalized6.match(/^::ffff:(\d[\d.]+)$/i);
+        if (v4DottedNorm) {
+            const normV4 = normalizeIPv4(v4DottedNorm[1]);
+            if (normV4) {
+                return isPrivateIPv4(normV4);
+            }
+            return true;
+        }
+        const v4HexNorm = normalized6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+        if (v4HexNorm) {
+            const hi = parseInt(v4HexNorm[1], 16);
+            const lo = parseInt(v4HexNorm[2], 16);
+            const mapped = ((hi >> 8) & 0xff) + '.' + (hi & 0xff) + '.' + ((lo >> 8) & 0xff) + '.' + (lo & 0xff);
+            return isPrivateIPv4(mapped);
+        }
         return false;
     }
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade Ghost instances to version 6.21.1 or later to apply the official patch.
  • Configure host-based firewall rules (iptables/nftables) to drop outbound traffic from the Ghost process to private subnets and local loopback.
  • Deploy WAF rules to detect and block incoming request payloads that contain expanded IPv4-mapped IPv6 addresses.

Remediation Steps:

  1. For standard Ghost CLI installations, run 'ghost update' to update to the latest patched version.
  2. For Docker-based deployments, pull the latest image tag using 'docker pull ghost:6.21.1' or update the docker-compose configuration.
  3. In AWS or other cloud environments, enforce IMDSv2 with a hop limit of 1 to prevent metadata access via container SSRF.

References

Read the full report for CVE-2026-53944 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)