CVE-2026-25552: Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxyaddxforwardedfor directive to present an arbitrary IP address, circumventing Ghost's rate-limiting mechanisms on self-hosted instances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghost CLIto a version that resolves this vulnerability.Fixed in 1.30.1 - Configuration
Fix the Nginx configuration so that the $proxy_add_x_forwarded_for directive cannot be used to append attacker-controlled values to the X-Forwarded-For header chain, preventing bypass of Ghost CLI rate-limiting.
Nginx (reverse proxy in front of Ghost CLI) $proxy_add_x_forwarded_for = Do not use attacker-controlled X-Forwarded-For values for the header chain (avoid enabling the directive in a way that allows appending attacker-controlled values)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25552?
CVE-2026-25552 has a medium severity score of 6.3.
How do I fix CVE-2026-25552?
To fix CVE-2026-25552, upgrade Ghost CLI to version 1.30.1 or later.
What type of vulnerability is CVE-2026-25552?
CVE-2026-25552 is an IP spoofing vulnerability.
What are the potential impacts of CVE-2026-25552?
CVE-2026-25552 allows unauthenticated remote attackers to bypass rate-limiting controls.
What configurations are affected by CVE-2026-25552?
CVE-2026-25552 is affected by misconfigured Nginx configurations that manipulate the X-Forwarded-For header.