{"id":"CVE-2026-53948","aliases":["GHSA-944x-pm95-3jpr"],"title":"Ghost: File Upload Content-Type Spoofing","summary":"Ghost: File Upload Content-Type Spoofing","severity":"medium","cvss":5.4,"cwe":["CWE-434"],"vendor":"ghost","product":"ghost","ecosystem":"npm","affected":["ghost >= 6.19.4, < 6.21.1"],"patched":["ghost 6.21.1"],"published":"2026-08-04","updated":"2026-08-04","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-944x-pm95-3jpr","references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-944x-pm95-3jpr"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53948"},{"url":"https://github.com/TryGhost/Ghost/pull/26751"},{"url":"https://github.com/TryGhost/Ghost/commit/d659e752d6636144d75b9aa94062cdbc88a16b21"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.21.1"},{"url":"https://github.com/advisories/GHSA-944x-pm95-3jpr"}],"tags":["ghsa","npm"],"epss":0.00226,"epssPercentile":0.13529,"ingestedAt":"2026-08-04T21:42:19.518Z","slug":"CVE-2026-53948","body":"## Overview\n\n### Impact\n\nInsufficient validation of the client-supplied `Content-Type` on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v6.19.4 up to v6.21.0.\n\n### Patches\n\nv6.21.1 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). \n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). \n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).\n\n## Affected packages\n\n- `ghost >= 6.19.4, < 6.21.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ghost 6.21.1`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}