CVE-2026-53948: Ghost File Upload Content-Type Spoofing Vulnerability
Summary
CVE-2026-53948: Ghost: File Upload Content-Type Spoofing. Affects ghost versions >= 6.19.4, < 6.21.1. Fixed in 6.21.1. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-53948 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It offers a user-friendly interface, customizable themes, and a robust API for developers. However, like many web applications, Ghost is susceptible to vulnerabilities that can compromise its security, particularly in its file upload functionalities.
Vulnerability Detail
The vulnerability arises from insufficient validation of the client-supplied 'Content-Type' on Ghost's Admin API file upload endpoint. This flaw allows attackers to upload files that can be served with an attacker-chosen content type when using S3 or GCS storage backends. If the uploaded files are served from the same origin as the site, it could lead to stored cross-site scripting (XSS) attacks, potentially affecting site visitors or staff. The vulnerability is present in Ghost versions from 6.19.4 up to 6.21.0, with a CVSS score of 5.4 indicating a moderate severity level.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.21.1
This is the first release that contains the fix.
npm install ghost@6.21.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads to specific file types and implement additional validation checks on the server-side to ensure that uploaded files are safe before serving them to users.
Conclusion
The Ghost file upload content-type spoofing vulnerability (CVE-2026-53948) poses a significant risk to installations of Ghost versions 6.19.4 to 6.21.0. It is crucial for users to update to version 6.21.1 or later to protect against potential XSS attacks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows attackers to upload files with a spoofed content type, potentially leading to stored XSS attacks.
Ghost versions from 6.19.4 up to 6.21.0 are vulnerable to this issue.
You can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up.
It is recommended to update to Ghost version 6.21.1 or later to mitigate the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities using just package-lock.json, making it easy to keep your applications secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
