Arbitrary File Upload Affecting ghost package, versions >=6.19.4 <6.21.2
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary File Upload vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-GHOST-17823278
- published6 Jul 2026
- disclosed24 Jun 2026
- creditUnknown
Introduced: 24 Jun 2026
NewCVE-2026-53948 (opens in a new tab)How to fix?
Upgrade ghost to version 6.21.2 or higher.
Overview
ghost is a publishing platform
Affected versions of this package are vulnerable to Arbitrary File Upload through the Admin API /files/upload endpoint in ghost/core/core/server/api/endpoints/files.js. An attacker can make uploaded files be served with an attacker-chosen content type by sending a file upload request with a forged Content-Type value. The endpoint passed the client-supplied MIME type to the storage adapter when saving files, so S3/GCS-backed installations could store and later serve an uploaded file as text/html or another active type. On sites that serve uploaded assets from the same origin, this can be used to deliver stored cross-site scripting to visitors or staff.
Notes
- On self-hosted installs using S3/GCS-backed file storage, the uploaded object metadata is what later drives the content type served from the storage backend; local filesystem storage is not the same exposure.
- The vulnerable path was the Admin API upload flow, so the spoofed type came from authenticated upload requests rather than public file-serving endpoints.