CVE-2026-53944— Ghost: Private IP filtering bypass to make server-side requests to internal services
Possible ATT&CK Techniques 2AI
T1590 · Gather Victim Network Information T1557 · Adversary-in-the-MiddleGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53944
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghost: Private IP filtering bypass to make server-side requests to internal services
Source: NVD (National Vulnerability Database)
Vulnerability Description
Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. This vulnerability is fixed in 6.21.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
不完整的黑名单
Source: NVD (National Vulnerability Database)
Vulnerability Title
Ghost 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ghost是Ghost基金会开源的一款内容管理平台。 Ghost 6.0.9至6.21.1版本存在安全漏洞，该漏洞源于IP过滤绕过，可能导致攻击者利用映射到私有IPv4地址的IPv6地址绕过内部服务访问限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-53944
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53944
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53944 (1)
Same Patch Batch · TryGhost · 2026-06-24 · 8 CVEs total
| CVE-2026-53943 | 9.6 CRITICAL | Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header |
| CVE-2026-53950 | 7.5 HIGH | @tryghost/activitypub: XSS in Ghost's ActivityPub client |
| CVE-2026-53948 | 5.4 MEDIUM | Ghost: File Upload Content-Type Spoofing |
| CVE-2026-53946 | 5.4 MEDIUM | Ghost: Mobiledoc image-size fetch SSRF |
| CVE-2026-53947 | 5.3 MEDIUM | Ghost: Member existence leak via magic link sign-in response |
| CVE-2026-53949 | 5.3 MEDIUM | Ghost Content API filter bypass reveals private fields |
| CVE-2026-53945 | 4.0 MEDIUM | Ghost: Server-side request forgery via DNS rebinding in external request handling |
IV. Related Vulnerabilities
Same product: Ghost
- CVE-2026-53943
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-pre - CVE-2026-53945
Ghost: Server-side request forgery via DNS rebinding in exte - CVE-2026-53946
Ghost: Mobiledoc image-size fetch SSRF - CVE-2026-53947
Ghost: Member existence leak via magic link sign-in response - CVE-2026-53948
Ghost: File Upload Content-Type Spoofing
Same vendor: TryGhost
- CVE-2026-53943
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-pre - CVE-2026-53945
Ghost: Server-side request forgery via DNS rebinding in exte - CVE-2026-53946
Ghost: Mobiledoc image-size fetch SSRF - CVE-2026-53947
Ghost: Member existence leak via magic link sign-in response - CVE-2026-53948
Ghost: File Upload Content-Type Spoofing
Same weakness: CWE-184
- CVE-2026-14534
Fickling check_safety() bypass via unlisted standard library - CVE-2026-56777
n8n - AST Validator Bypass in Python Code Node - CVE-2025-71355
Picklescan - Arbitrary Code Execution via Unsafe Numpy Funct - CVE-2026-47389
Mastodon: SSRF protection bypass on older Ruby versions - CVE-2026-54512
jackson-databind: PolymorphicTypeValidator bypass via generi
V. Comments for CVE-2026-53944
No comments yet