CVE-2026-53948: Ghost: File Upload Content-Type Spoofing
Impact
Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff.
Vulnerable versions
This vulnerability is present in Ghost from v6.19.4 up to v6.21.0.
Patches
v6.21.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Other sources
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff. This vulnerability is fixed in 6.21.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.21.1 - Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.21.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53948?
The severity of CVE-2026-53948 is classified as medium with a score of 5.4.
How do I fix CVE-2026-53948?
To mitigate CVE-2026-53948, update Ghost to version 6.21.2 or later where the issue is addressed.
What systems are affected by CVE-2026-53948?
CVE-2026-53948 affects Ghost versions 6.19.4 to 6.21.1.
What type of vulnerability is CVE-2026-53948?
CVE-2026-53948 is classified as a Malicious File Upload vulnerability.
What are the potential risks associated with CVE-2026-53948?
The potential risks include the ability for attackers to upload files that can be served with a malicious content type, leading to further exploitation.