Ghost, a Node.js content management system, had a vulnerability (CWE-434) in versions 6.19.4 through 6.21.0 where the Admin API file upload endpoint did not properly validate the Content-Type header supplied by clients. This allowed attackers to upload files that could be served with arbitrary content types on S3 or Google Cloud Storage backends. When installations serve uploaded files from the same origin as the site, this flaw could facilitate stored cross-site scripting attacks against site visitors or staff. The issue is resolved in Ghost version 6.21.1.

An attacker could upload files with malicious content that are served with attacker-chosen content types, potentially enabling stored cross-site scripting attacks on users and administrators of affected Ghost sites. This could lead to unauthorized script execution in the context of the vulnerable site, impacting confidentiality and integrity. Availability is not affected.

A fix is available in Ghost version 6.21.1. Since this is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify that their installations are updated to 6.21.1 or later. Patch status is confirmed by the vendor advisory stating the vulnerability is fixed in 6.21.1.