Provisional finding. Full causal and release verification remains incomplete.
Ghost served uploaded files with a type taken from their extension. The Cursor-assisted 6.22.1 hardening set a safe type that the default local storage adapter discarded, so any staff user could host script on the site origin. Local storage behaved this way since 4.32.1 through human-written code; 6.64.0 fixes it.
AI-assisted change
The Cursor-assisted change added extension checks and a helper that maps executable uploads to inert content types, but the default local storage adapter discarded the computed type.
Root cause
Because local storage has had no place to keep the computed type since human-written 4.32.1 code, serving still derived Content-Type from the file extension, allowing script to run on the site origin.
Fix
The repair adds nosniff and makes LocalFilesStorage override the served Content-Type with the inert type map, closing the script-execution path for staff-uploaded files.
Case facts
CursorCite this finding
Vibe Security Radar, "CVE-2026-105679 in TryGhost/Ghost," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-105679/
@@ -52,6 +52,10 @@ const messages = { thumbnail: { missingFile: 'Please select a thumbnail.', invalidFile: 'Please select a valid thumbnail.'+ },+ files: {+ missingFile: 'Please select a file.',+ invalidFile: 'The file type you uploaded is not supported. You can zip your file and upload it as a .zip.' } }; @@ -356,11 +360,48 @@ const mediaValidation = function ({type}) { }; }; +/**+ * Extension-only validation for file uploads.+ * This validates the extension against the allowlist. + * We are not validating the MIME type because it is unreliable and irrelevant as + * we derive the storage content type from the extension via getStorageContentType().+ *+ * @param {Object} options+ * @param {String} options.type - config key under uploads (e.g. 'files')+ * @returns {import('express').RequestHandler}+ */+const fileValidation = function ({type}) {+ return function fileUploadValidation(req, res, next) {+ const extensions = (config.get('uploads')[type] && config.get('uploads')[type].extensions) || [];++ req.file = req.file || {};+ req.file.name = req.file.originalname;+ req.file.type = req.file.mimetype;++ if (!checkFileExists(req.file)) {+ return next(new errors.ValidationError({+ message: tpl(messages[type].missingFile)+ }));+ }++ req.file.ext = path.extname(req.file.name).toLowerCase();++ if (!extensions.includes(req.file.ext)) {+ return next(new errors.UnsupportedMediaTypeError({+ message: tpl(messages[type].invalidFile, {extensions: extensions})+ }));+ }++ next();+ };+};+ module.exports = { single, media, validation,- mediaValidation+ mediaValidation,+ fileValidation }; // Exports for testing only@@ -323,6 +323,7 @@ module.exports = function apiRoutes() { router.post('/files/upload', mw.authAdminApi, apiMw.upload.single('file'),+ apiMw.upload.fileValidation({type: 'files'}), http(api.files.upload) ); @@ -0,0 +1,59 @@+const path = require('path');+const mime = require('mime-types');++const CONTENT_TYPE_OVERRIDES = new Map([+ ['.html', 'text/plain'],+ ['.htm', 'text/plain'],+ ['.js', 'text/plain'],+ ['.css', 'text/plain'],+ ['.xml', 'text/plain']+]);++const BROWSER_RENDERABLE_TYPES = new Set([+ 'image/jpeg',+ 'image/png',+ 'image/gif',+ 'image/webp',+ 'application/pdf',+ 'application/json',+ 'audio/mpeg',+ 'audio/wave',+ 'audio/mp4',+ 'video/mp4',+ 'video/quicktime',+ 'font/otf',+ 'font/woff',+ 'font/woff2',+ 'text/plain'+]);++/**+ * Determines the content type to store/serve for a given filename.+ *+ * Three-tier resolution:+ * 1. Override map — forced to text/plain to prevent browser execution+ * 2. Browser-renderable — type preserved as safe for browser rendering+ * 3. Fallback — application/octet-stream to force download+ *+ * @param {string} filename+ * @returns {string} content type to store+ */+function getStorageContentType(filename) {+ const ext = path.extname(filename).toLowerCase();++ const override = CONTENT_TYPE_OVERRIDES.get(ext);+ if (override) {+ return override;+ }++ const mimeType = mime.lookup(ext);+ if (mimeType && BROWSER_RENDERABLE_TYPES.has(mimeType)) {+ return mimeType;+ }++ return 'application/octet-stream';+}++module.exports = {+ getStorageContentType+};@@ -258,18 +258,32 @@ class LocalStorageBase extends StorageBase { } } + /**+ * Sets response headers for a file about to be served from local storage.+ * `send` only derives Content-Type from the extension when it hasn't been+ * set yet, so subclasses can override this to enforce their own type.+ *+ * `nosniff` stops browsers from second-guessing the declared Content-Type+ * based on the file's contents.+ */+ setServeHeaders(res: Response, _filePath: string): void {+ res.setHeader('X-Content-Type-Options', 'nosniff');+ }+ /** * For some reason send divides the max age number by 1000 * Fallthrough: false ensures that if an image isn't found, it automatically 404s * Wrap server static errors */ serve(): RequestHandler { const { storagePath, errorMessages } = this;+ const setHeaders = (res: Response, filePath: string) => this.setServeHeaders(res, filePath); return function serveStaticContent(req: Request, res: Response, next: NextFunction) { return serveStatic(storagePath, { maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year in ms fallthrough: false,+ setHeaders, })(req, res, (err?: ServeStaticError) => { if (err) { if (err.statusCode === 404) {@@ -1,7 +1,9 @@ // # Local File System Storage module // The (default) module for storing media, using the local file system+import type { Response } from 'express'; import config from '../../../shared/config'; import urlUtils from '../../../shared/url-utils';+import { getStorageContentType } from '../../services/files/file-type-utils'; import LocalStorageBase from './LocalStorageBase'; const messages = {@@ -19,6 +21,18 @@ class LocalFilesStorage extends LocalStorageBase { errorMessages: messages, }); }++ /**+ * The files upload endpoint resolves an inert content type for each file+ * (e.g. .html -> text/plain, .svg -> application/octet-stream), which S3+ * stores alongside the object. Local storage has nowhere to keep it, so+ * resolve it again here instead of letting express.static derive a+ * browser-executable type from the extension.+ */+ setServeHeaders(res: Response, filePath: string): void {+ super.setServeHeaders(res, filePath);+ res.setHeader('Content-Type', getStorageContentType(filePath));+ } } export default LocalFilesStorage;AI-assisted change 3d5ebb614b17a6fcd5d78220b7131bc890e7b887697407a57b5a98a8bc8e4972 · Fix 75c0e8c9367f418cfa1823a1538614589cea07d50406313da0b03deb94577c24
CVE-2026-100353Oct 15, 2026getkin/kin-openapi
Go
ClaudeFlawed AI-written codeInjection & unsafe execution
CVE-2026-108260Oct 9, 2026tinacms/tinacms
TypeScriptClaudeFlawed AI-written codeInjection & unsafe execution
CVE-2026-105744Oct 7, 2026docling-project/docling
PythonClaudeFlawed AI-written codeInjection & unsafe execution
CVE-2026-41510Oct 6, 2026corazawaf/corazaGoClaudeFlawed AI-written codeInjection & unsafe execution
MediumCVE-2026-76760Aug 20, 2026chenhg5/cc-connectGoClaudeDirect introductionInjection & unsafe execution