CVE-2026-103287 is a server-side request forgery vulnerability affecting the Ghost blogging platform in versions >=1.18.0 and <6.27.0. The issue exists in the webhooks feature, where authenticated staff users can manipulate webhook requests to access internal network resources from the server hosting Ghost. This could allow internal network reconnaissance but requires staff-level privileges to exploit.

An attacker with staff privileges can exploit this SSRF vulnerability to make the Ghost server send crafted requests to internal hosts, potentially exposing internal network resources. There is no indication of remote unauthenticated exploitation or privilege escalation beyond staff users. No known exploits are reported in the wild.

A fix is available in Ghost version 6.27.0 and later. Users should upgrade to version 6.27.0 or above to remediate this vulnerability. Since this is not a cloud service, patching the affected software is required. No additional vendor advisory content is provided, so check official Ghost release notes for detailed remediation instructions.