Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M
CVE-2026-53948Ghost: File Upload Content-Type Spoofing
Medium 5.4
In plain English
A medium-severity unrestricted file upload in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff. This vulnerability is fixed in 6.21.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | ghost | 6.21.1 | GHSA-944x-pm95-3jpr |
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-944x-pm95-3jpr x_refsource_CONFIRM