Junglewise Threat Intelligence

CVE-2026-53948: TryGhost Ghost stored XSS via Content-Type spoofing in Admin API

CVE-2026-53948 · Severity: medium · CVSS 5.4 · Published 2026-06-24

Technologies: ghost (npm). Vendors: npm.

Executive brief

Ghost is a popular open-source content management system used for professional publishing. A security flaw in the administrative file upload system allowed attackers to manipulate how uploaded files are identified by web browsers. This could allow an attacker to upload a malicious file that, when viewed by other users or staff, executes unauthorized scripts in their browser, potentially leading to account takeover or data theft.

Technical details

A vulnerability exists in the Ghost Admin API's file upload endpoint due to insufficient validation of the client-supplied 'Content-Type' header. When using S3 or Google Cloud Storage (GCS) backends, the application trusted the MIME type provided by the client during upload. An attacker with administrative API access could upload a file (such as an HTML file) while spoofing its Content-Type to bypass security filters. If the files are served from the same origin as the main site, this enables stored Cross-Site Scripting (XSS) against visitors or other administrators. The fix, introduced in version 6.21.1, involves deriving the MIME type server-side from the file extension using the 'mime-types' library instead of trusting the user-supplied value.

Affected products

  • TryGhost Ghost >= 6.19.4, < 6.21.1

Timeline

  • 2026-03-10: patched: Fix merged into main branch via Pull Request #26751
  • 2026-06-10: disclosed: Initial advisory publication
  • 2026-06-24: advisory: NVD publication date
  • 2026-08-04: advisory: GitHub Advisory updated and reviewed

References

Related threats