IP Spoofing Vulnerability in Ghost CLI by Ghost

CVE-2026-25552

What is CVE-2026-25552?

Ghost CLI versions before 1.30.1 are susceptible to an IP spoofing vulnerability that enables unauthenticated remote attackers to evade rate-limiting controls. This exploit occurs by modifying the X-Forwarded-For header through a potentially misconfigured Nginx setup. Attackers are able to inject malicious values into this header, using the $proxy_add_x_forwarded_for directive, to display an arbitrary IP address. This undermines Ghost's self-hosting rate-limiting protections, allowing for potential abuse and further attack opportunities.

References