CVE-2026-25552 affects Ghost CLI before version 1.30.1. The vulnerability arises from the use of less trusted sources for IP address determination when rate-limiting is enforced. Specifically, a misconfigured Nginx setup using the $proxy_add_x_forwarded_for directive allows attackers to manipulate the X-Forwarded-For header by appending arbitrary IP addresses. This enables unauthenticated remote attackers to bypass Ghost's rate-limiting mechanisms by presenting spoofed IP addresses, potentially allowing excessive requests that would otherwise be blocked.

Attackers can bypass rate-limiting controls on self-hosted Ghost instances by spoofing IP addresses in the X-Forwarded-For header. This could lead to denial of service or resource exhaustion by allowing an attacker to send more requests than intended by the rate-limiting policy. There is no indication of privilege escalation or direct code execution from this vulnerability.

A fixed version 1.30.1 of Ghost CLI addresses this vulnerability. Users should upgrade to version 1.30.1 or later to remediate this issue. Until patched, administrators should review and correctly configure their Nginx proxy settings to avoid trusting attacker-controlled X-Forwarded-For header values, ensuring that rate-limiting is applied based on reliable client IP information.