{"uuid": "c81a3357-5f42-4455-91c6-4447bc722524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-944x-pm95-3jpr", "type": "seen", "source": "https://gist.github.com/alon710/f15b7efa1dfc268f551e391b3e8839f1", "content": "# CVE-2026-53948: CVE-2026-53948: Stored Cross-Site Scripting via File Upload Content-Type Spoofing in Ghost\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53948\n\n## Summary\nCVE-2026-53948 is a stored cross-site scripting (XSS) vulnerability in the Ghost content management system. Affected versions (v6.19.4 up to v6.21.0) trusted the client-supplied Content-Type header during file uploads via the Admin API. This allowed authenticated attackers to upload benignly-named files with executable MIME types (like text/html), executing scripts in visitor browsers when hosted on integrated cloud platforms like S3 or GCS.\n\n## TL;DR\nGhost versions 6.19.4 to 6.21.0 are vulnerable to Stored Cross-Site Scripting because they trust client-provided file MIME types during upload. Authenticated users can spoof content types to serve HTML scripts from cloud backends, compromising visitors and administrators. This issue is resolved in version 6.21.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-434\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.4 (Medium)\n- **Exploit Status**: PoC Concept available\n- **CISA KEV Status**: Not listed\n- **Impact**: Stored Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 6.19.4, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost to v6.21.1 or later\n- Enable 'X-Content-Type-Options: nosniff' header on web proxy\n- Configure storage buckets to serve assets from a sandboxed domain\n\n**Remediation Steps:**\n1. Identify active Ghost version running on host\n2. Execute upgrade to 6.21.1 using 'ghost update' command\n3. Verify that files are served with headers corresponding strictly to their extension mapped server-side\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-944x-pm95-3jpr)\n- [GitHub Fix Commit](https://github.com/TryGhost/Ghost/commit/d659e752d6636144d75b9aa94062cdbc88a16b21)\n- [GitHub Pull Request](https://github.com/TryGhost/Ghost/pull/26751)\n- [v6.21.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-53948)\n- [CVE Org Entry](https://www.cve.org/CVERecord?id=CVE-2026-53948)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53948) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T10:31:29.907223Z"}