CVE-2026-53948: Ghost: File Upload Content-Type Spoofing
Insufficient validation of the client-supplied Content-Type on Ghost’s Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff.
References
- github.com/TryGhost/Ghost/commit/d659e752d6636144d75b9aa94062cdbc88a16b21
- github.com/TryGhost/Ghost/pull/26751
- github.com/TryGhost/Ghost/releases/tag/v6.21.1
- github.com/TryGhost/Ghost/security/advisories/GHSA-944x-pm95-3jpr
- github.com/advisories/GHSA-944x-pm95-3jpr
- nvd.nist.gov/vuln/detail/CVE-2026-53948
Code Behaviors & Features
Detect and mitigate CVE-2026-53948 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →