CVE-2026-53948: CVE-2026-53948: Stored Cross-Site Scripting via File Upload Content-Type Spoofing in Ghost

#security #cve #cybersecurity

CVE-2026-53948: Stored Cross-Site Scripting via File Upload Content-Type Spoofing in Ghost

Vulnerability ID: CVE-2026-53948
CVSS Score: 5.4
Published: 2026-08-04

CVE-2026-53948 is a stored cross-site scripting (XSS) vulnerability in the Ghost content management system. Affected versions (v6.19.4 up to v6.21.0) trusted the client-supplied Content-Type header during file uploads via the Admin API. This allowed authenticated attackers to upload benignly-named files with executable MIME types (like text/html), executing scripts in visitor browsers when hosted on integrated cloud platforms like S3 or GCS.

TL;DR

Ghost versions 6.19.4 to 6.21.0 are vulnerable to Stored Cross-Site Scripting because they trust client-provided file MIME types during upload. Authenticated users can spoof content types to serve HTML scripts from cloud backends, compromising visitors and administrators. This issue is resolved in version 6.21.1.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-434
Attack Vector: Network
CVSS v3.1 Score: 5.4 (Medium)
Exploit Status: PoC Concept available
CISA KEV Status: Not listed
Impact: Stored Cross-Site Scripting (XSS)

Affected Systems

Ghost CMS
Ghost: >= 6.19.4, < 6.21.1 (Fixed in: 6.21.1)

Code Analysis

Commit: d659e75

Derive file MIME type programmatically based on extension instead of relying on client-supplied mimetype header to resolve stored metadata content-type spoofing vulnerability.

@@ -13,7 +14,7 @@ const controller = {
             const filePath = await storage.getStorage('files').save({
                 name: frame.file.originalname,
                 path: frame.file.path,
-                type: frame.file.mimetype
+                type: mime.lookup(frame.file.originalname) || 'application/octet-stream'
             });

Mitigation Strategies

Upgrade Ghost to v6.21.1 or later
Enable 'X-Content-Type-Options: nosniff' header on web proxy
Configure storage buckets to serve assets from a sandboxed domain

Remediation Steps:

Identify active Ghost version running on host
Execute upgrade to 6.21.1 using 'ghost update' command
Verify that files are served with headers corresponding strictly to their extension mapped server-side

References

Read the full report for CVE-2026-53948 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community