MEDIUM 5.4 GitHub
CVE-2026-53948
Ghost: File Upload Content-Type Spoofing
### Impact
Insufficient validation of the client-supplied `Content-Type` on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff.
### Vulnerable versions
This vulnerability is present in Ghost from v6.19.4 up to v6.21.0.
Affected Products
- npm/ghost >= 6.19.4, < 6.21.1
References
- https://github.com/advisories/GHSA-944x-pm95-3jpr
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-944x-pm95-3jpr
- https://nvd.nist.gov/vuln/detail/CVE-2026-53948
- https://github.com/TryGhost/Ghost/pull/26751
This medium severity vulnerability with a CVSS score of 5.4 was published on 2026-08-04 via GitHub. Affected: npm/ghost >= 6.19.4, < 6.21.1.
vulnfeed aggregates 9214 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.