CVE-2026-53944 is an incomplete input validation vulnerability in the TryGhost Ghost CMS. Specifically, the IP filtering mechanism intended to prevent external requests from reaching internal services can be bypassed by using IPv6 literals that map to private IPv4 addresses. This affects versions from 6.0.9 up to but not including 6.21.1. The vulnerability is categorized under CWE-184 (Incomplete List of Disallowed Inputs) and CWE-918 (Server-Side Request Forgery). It has a CVSS 3.1 base score of 5.8 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The vulnerability allows integrity impact but no confidentiality or availability impact. No known exploits in the wild have been reported. The issue is fixed in version 6.21.1.

An attacker can bypass the IP filtering controls in Ghost CMS to make unauthorized external requests that reach internal services by exploiting the incomplete validation of IPv6 literals mapping to private IPv4 addresses. This can lead to integrity issues, such as unauthorized actions or data manipulation within internal services. There is no reported impact on confidentiality or availability. The vulnerability does not require privileges or user interaction to exploit.

A fix is available in Ghost version 6.21.1. Users should upgrade to version 6.21.1 or later to remediate this vulnerability. Since this is a self-hosted product, administrators must apply the update manually. Patch status is confirmed by the vendor advisory stating the issue is fixed in 6.21.1. No additional mitigations are specified.