Back to overview

CVE-2026-53948

MEDIUM
5.4
CVSS 3.1
Description
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff. This vulnerability is fixed in 6.21.1.

Metadata

CVE ID
CVE-2026-53948
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-11 15:50 UTC
Published
2026-06-24 18:06 UTC
Last updated
2026-06-24 18:06 UTC
Primary CWE
CWE-434
CWE-434: Unrestricted Upload of File with Dangerous Type
Vendor / Product
TryGhost / Ghost
Sources
cve.org  ·  NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products (1)
VendorProductPlatformVersions
TryGhost Ghost — >= 6.19.4, < 6.21.1
Weakness (CWE)
CWESourceDescription
CWE-434 cna CWE-434: Unrestricted Upload of File with Dangerous Type
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.4 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References (1)
Back to overview