CVE-2026-105647: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in TryGhost Ghost

CVE-2026-105647 describes a TOCTOU race condition vulnerability in Ghost CMS versions >=6.54.1 and <6.65.0. Due to a validation issue, unauthenticated attackers could exploit features like Webmentions to initiate limited HTTP requests to internal network hosts of the Ghost server. The vulnerability does not expose response data but may allow internal network scanning or interaction. The vulnerability is resolved in Ghost version 6.65.0.

The vulnerability allows unauthenticated attackers to make limited HTTP requests to internal network hosts via Ghost's Webmentions feature, potentially enabling reconnaissance of internal network resources. No response data is returned, limiting the impact to information gathering rather than data disclosure or system compromise. The CVSS 3.1 base score is 4.0 (medium severity), reflecting network attack vector with high attack complexity and no privileges or user interaction required, with limited confidentiality impact and no integrity or availability impact.

Upgrade Ghost to version 6.65.0 or later, where this TOCTOU race condition vulnerability is fixed. No other mitigation actions are indicated by the vendor advisory.