CVE-2026-53948
Description
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff. This vulnerability is fixed in 6.21.1.
Summary dbcve.org
Ghost's Admin API file upload endpoint insufficiently validated the client-supplied Content-Type header, allowing attackers to upload files with arbitrary MIME types. When storage backends (S3/GCS) serve these files with attacker-controlled content types, and when files are served from the same origin as the site, this enables stored XSS against visitors or staff.
Mitigation
Upgrade Ghost to version 6.21.1 or later, which contains the fix for proper Content-Type validation on file uploads.