Listen to this Post
How CVE-2026-53948 Works
Ghost is a popular Node.js-based content management system. From versions 6.19.4 up to 6.21.0, the Admin API’s file upload endpoint (/files/upload) suffered from insufficient validation of the `Content-Type` header supplied by the client. When a file is uploaded via this endpoint, Ghost passes the client-supplied MIME type directly to the underlying storage adapter. On installations using S3 or GCS as the storage backend, this MIME type is stored as object metadata. Later, when the file is served, the storage backend uses this metadata to set the `Content-Type` response header. By forging the `Content-Type` in the upload request, an attacker can cause an uploaded file—such as an HTML or JavaScript file—to be served with an active MIME type like text/html.
The vulnerability resides in ghost/core/core/server/api/endpoints/files.js, where the endpoint passes the client-controlled MIME type to the storage adapter without proper sanitization. The fix in v6.21.1 enforces proper MIME type validation and uses `mime.lookup` based on file extension rather than trusting the client-supplied value. On sites that serve uploaded files from the same origin as the main application, this flaw can be exploited to deliver stored cross-site scripting (XSS) payloads to visitors or staff members. The attack requires authenticated access to the Admin API (low privileges) and some user interaction, with a CVSS base score of 5.4 (Medium).
DailyCVE Form:
Platform: Ghost CMS
Version: 6.19.4–6.21.0
Vulnerability: CWE-434 / XSS
Severity: Medium (CVSS 5.4)
Date: June 24, 2026
Prediction: Patch expected v6.21.1
What Undercode Say: Analytics
Check current Ghost version
ghost version
For Docker installs
docker exec <container_name> node -p "require('./package.json').version"
Check storage adapter configuration
ghost config get storage
Search logs for suspicious uploads (example)
grep -i "content-type" /path/to/ghost/logs/.log | grep -E "text/html|application/javascript"
Verify if files are served from same origin
curl -I https://your-ghost-site.com/content/images/uploaded-file.html
Code snippet of vulnerable endpoint logic (simplified):
// ghost/core/core/server/api/endpoints/files.js (vulnerable)
const uploadFile = async (file, options) => {
const storage = getStorage(options);
// Directly uses client-supplied Content-Type
const result = await storage.save(file, {
contentType: file.contentType // <-- Attacker-controlled
});
return result;
};
Patched logic (v6.21.1):
// Fixed: Validate and determine MIME type from file extension
const mime = require('mime');
const contentType = mime.lookup(file.name) || 'application/octet-stream';
const result = await storage.save(file, {
contentType: contentType // <-- Determined server-side
});
Exploit
An authenticated attacker with access to the Ghost Admin API can upload a malicious HTML file containing an XSS payload while forging the `Content-Type` header to text/html:
curl -X POST https://target-ghost.com/ghost/api/admin/files/upload \ -H "Authorization: Bearer <admin_api_token>" \ -H "Content-Type: multipart/form-data" \ -F "[email protected];type=text/html"
The uploaded file is stored on S3/GCS with Content-Type: text/html. When a victim visits the file’s URL, the browser executes the embedded JavaScript in the context of the Ghost site’s origin, enabling stored XSS against visitors or staff.
Protection
- Upgrade Ghost to version 6.21.1 or later immediately.
- For Docker-based installs, pull the latest official Ghost image.
- For Ghost-CLI installs, run `ghost update` to apply the patch.
- If immediate upgrade is not possible, restrict Admin API upload privileges to only trusted users.
- Consider serving uploaded files from a separate CDN domain rather than the same origin as the main site.
- Review recent upload logs for unusual file types or suspicious `Content-Type` metadata from the affected window.
Impact
Successful exploitation allows an attacker to perform stored cross-site scripting (XSS) against site visitors and administrative staff. This can lead to session hijacking, credential theft, defacement, and unauthorized actions performed on behalf of authenticated users. The impact is heightened on installations that serve uploaded files from the same origin as the Ghost site, as the XSS payload executes with full trust of the application’s origin. While no active exploitation has been reported in the wild, organizations running affected versions should treat this as a high-priority patch.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
