Summary
Ghost versions 6.22.1 through before 6.64.0 contain a stored cross-site scripting vulnerability in the default local storage adapter. A user who can upload files may place script-bearing content on the site's domain, which could execute in other staff users' browsers and compromise their administrative sessions.
Affected context
The issue occurs in Ghost deployments using the default local storage adapter when uploaded files are served from the site's domain with content types derived from their extensions. Risk is higher where staff users can upload files and other privileged staff members can access or preview those files through the administrative interface.
Exploit preconditions
- Attack surface: File upload and file-serving functionality on a Ghost site
- Required access: Authenticated staff-level access or another capability that permits file uploads
- Trigger point: A different staff user loads the uploaded resource or a page that references it
- Why exploitation is possible: Script-bearing content may be hosted under the trusted site origin and interpreted by the browser in a privileged staff context
Why this happens
The vulnerability results from insufficient separation between uploaded content and executable web content. When file handling relies on extension-derived content types without adequately restricting active content, an uploaded file can be served from a trusted origin and interpreted as script.
This maps to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically a stored XSS pattern in which attacker-controlled content persists on the server and executes when another user accesses it.
Potential impact
- An attacker may execute script in another staff user's browser
- Administrative sessions or tokens could be exposed
- Unauthorized administrative actions could be performed
- Site content, settings, or user data could be modified
- The site could be used to distribute malicious content to privileged users
General mitigation guidance
Mitigation generally focuses on treating uploaded files as untrusted data and preventing active content from being served under a privileged site origin.
Common defensive patterns include:
- Restricting uploads to an allowlist of non-executable file types
- Validating file content using independent content inspection rather than extensions alone
- Serving user-controlled files from an isolated origin or download-only endpoint
- Applying safe, consistent content-disposition and content-type policies
- Enforcing context-appropriate output encoding and strong browser security headers
- Limiting upload permissions according to least privilege
- Preventing uploaded content from being embedded or rendered in administrative contexts
How teams detect issues like this
Organizations commonly detect stored XSS risks through:
- Static analysis and code review checks for user-controlled upload paths
- Review of extension-to-content-type mappings and file-serving responses
- Tests that upload active-content file variants and verify non-executable handling
- Monitoring for unusual staff uploads, script-bearing files, and access to uploaded resources
- Policy enforcement requiring isolated origins for untrusted user content
Automated application security testing can help identify stored script execution across upload, storage, and rendering workflows.
