CVE-2026-25552
Low · 3.7CVSS
3.7
EPSS
0.2%
Published
Jul 31, 2026
CISA due date
—
The record
Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxy_add_x_forwarded_for directive to present an arbitrary IP address, circumventing Ghost's rate-limiting mechanisms on self-hosted instances.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112378 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before… CWE-348
- CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-348
- CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-348
- CVE-2026-16732 fastify is a fast and low overhead web framework for Node.js. CWE-348
- CVE-2026-63220 CodeIgniter is a PHP full-stack web framework. CWE-348
- CVE-2026-50243 In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with… CWE-348
- CVE-2026-63770 Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication… CWE-348
- CVE-2026-9561 Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP… CWE-348