CVE-2026-25552: Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxyaddxforwardedfor directive to present an arbitrary IP address, circumventing Ghost's rate-limiting mechanisms on self-hosted instances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghost CLIto a version that resolves this vulnerability.Fixed in 1.30.1 - Configuration
Fix the Nginx configuration so that the $proxy_add_x_forwarded_for directive cannot be used to append attacker-controlled values to the X-Forwarded-For header chain, preventing bypass of Ghost CLI rate-limiting.
Nginx (reverse proxy in front of Ghost CLI) $proxy_add_x_forwarded_for = Do not use attacker-controlled X-Forwarded-For values for the header chain (avoid enabling the directive in a way that allows appending attacker-controlled values)