Ghost CMS versions >=6.19.4 and <6.21.1 have a CWE-434 vulnerability where the Admin API file upload endpoint does not properly validate the Content-Type header supplied by clients. This allows attackers to upload files that are served with arbitrary content types on S3/GCS storage backends. When files are served from the same origin as the site, this can facilitate stored cross-site scripting (XSS) attacks. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) and is fixed in version 6.21.1. The product is a cloud service, so the vendor manages remediation for hosted instances.

An attacker can upload files with attacker-controlled content types that are served from the site, potentially enabling stored cross-site scripting attacks against site visitors or administrative staff. This can lead to partial compromise of confidentiality and integrity via script execution in the context of the vulnerable site. Availability is not impacted. The vulnerability requires at least low privileges and user interaction.

A fix is available in Ghost version 6.21.1. For cloud-hosted instances, the vendor manages remediation server-side. Users should upgrade to version 6.21.1 or later to address this vulnerability. Until patched, administrators should be cautious about file uploads and serving uploaded files from the same origin.