CVE-2026-53944
Description
Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. This vulnerability is fixed in 6.21.1.
Summary dbcve.org
Ghost CMS contains an SSRF vulnerability where the IP filter designed to block requests to internal/private networks can be bypassed using IPv6 literal representations that map to private IPv4 addresses (e.g., IPv6-mapped IPv4 addresses). An attacker can use addresses like ::ffff:192.168.x.x to access internal services that should be protected.
Mitigation
Upgrade Ghost to version 6.21.1 or later, which includes proper IPv6 handling in the IP filter validation logic.