CVE-2026-25552 affects Ghost CLI versions before 1.30.1 and involves an IP spoofing vulnerability. Attackers can exploit a misconfigured Nginx setup that uses the $proxy_add_x_forwarded_for directive to append attacker-controlled IP addresses to the X-Forwarded-For header. This manipulation allows unauthenticated remote attackers to bypass rate-limiting protections implemented by Ghost on self-hosted instances, potentially leading to abuse of service resources. The vulnerability is due to trusting less reliable sources for client IP information.

The vulnerability enables attackers to bypass rate-limiting controls by spoofing IP addresses in the X-Forwarded-For header, potentially allowing increased request rates beyond intended limits. This could lead to resource exhaustion or denial of service conditions on affected self-hosted Ghost instances. There is no indication of privilege escalation or direct code execution. No known exploits in the wild have been reported.

No official patch or remediation level has been confirmed at this time. Users should verify their Nginx configurations to ensure that the X-Forwarded-For header is handled securely and consider implementing additional validation or filtering to prevent IP spoofing. Monitoring for updates from the vendor is recommended to apply any forthcoming official fixes.