Is CVE-2026-103291 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-103291?

CVE-2026-103291 has a CVSS v3 severity of MEDIUM (6.4).

Back

CVE-2026-103291

Description

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network endpoints to access metadata services and internal resources unavailable from the public internet.