Ghost CLI CVE-2026-25552

Exploitation requires three concurrent conditions: (1) Ghost CLI version prior to 1.30.1 must have generated the site's Nginx configuration; (2) Nginx must be configured with proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for - this is the specific directive that appends attacker-controlled header values rather than overwriting them with the real connecting IP; and (3) the attacker must have network-level access to the Ghost HTTP/HTTPS endpoint. No authentication is required (CVSS 4.0 PR:N). Ghost(Pro) managed hosting is explicitly not affected. The AT:P designation in the CVSS 4.0 vector confirms the Nginx directive is a required precondition, meaning instances using $remote_addr or no X-Forwarded-For forwarding are not vulnerable. Exploitation does not yield code execution or direct credential disclosure - it removes the rate-limiting barrier, enabling downstream attacks such as brute-force or enumeration.

The CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) reflects moderate real-world risk: network-reachable with no authentication required and low attack complexity, but bounded by a specific attack-target prerequisite (AT:P) - the Nginx $proxy_add_x_forwarded_for directive must be present. The VC:L impact is consistent with the vulnerability enabling enumeration and brute-force beyond what rate limits would normally permit, with no direct integrity or availability consequence from the bypass itself. No EPSS score was supplied in the intelligence feed, so exploitation probability cannot be quantified from that signal. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept code was identified, distinguishing this from an immediately weaponized risk. The AT:P constraint meaningfully limits the exploitable population to self-hosted Ghost instances specifically using the affected Nginx directive - Ghost(Pro) cloud-hosted deployments and instances using $remote_addr in their Nginx config are not affected. Overall this is a real but targeted risk: trivial to exploit when conditions are met, but the AT:P prerequisite and absence of known active exploitation place this below the urgency threshold of an unconditional remote code execution.

An attacker targeting a self-hosted Ghost blog sends repeated login or API requests, each with a different fabricated IP value in the X-Forwarded-For header (e.g., X-Forwarded-For: 192.0.2.1, then X-Forwarded-For: 192.0.2.2), and the $proxy_add_x_forwarded_for Nginx directive causes Ghost to treat each request as originating from a distinct IP, resetting the rate-limit counter every time. This allows unlimited brute-force of Ghost admin credentials or abuse of any rate-limited endpoint - such as password reset or signup flows - without triggering lockout or alerting. No publicly known exploit code is required; the technique is well-understood HTTP header manipulation requiring only standard HTTP tools.