CVE-2026-53948

Name of the Vulnerable Software and Affected Versions Ghost versions 6.19.4 through 6.21.0

Description Insufficient validation of the client-supplied Content-Type on the Admin API file upload endpoint allows uploaded files to be served with an attacker-chosen content type when using S3 or GCS storage backends. On installations where uploaded files are served from the same origin as the site, this can facilitate stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the target server and executed in the browser of site visitors or staff.

Recommendations Update to version 6.21.1.