CVE-2026-25552
Low
Description
Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxy_add_x_forwarded_for directive to present an arbitrary IP address, circumventing Ghost's rate-limiting mechanisms on self-hosted instances.
SeverityLow
CVSS3.7
Exploit probability—
ProductGhost-CLI
PublishedJul 31, 2026
First seenJul 31, 2026
Weakness typeCWE-348CWE-348
How to fix
Update
- TryGhost Ghost-CLI1.30.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TryGhost Ghost-CLI | v < 1.30.1 | 1.30.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.