| Package | Affected versions | Patched versions |
|---|---|---|
| ghost | ≥ 6.19.4, < 6.21.1 | 6.21.1 |
Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff.
This vulnerability is present in Ghost from v6.19.4 up to v6.21.0.
v6.21.1 contains a fix for this issue.
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
If you have any questions or comments about this advisory, email us at [email protected].
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free