Ghost CLI before version 1.30.1 allows an unauthenticated remote attacker to manipulate the X‑Forwarded‑For header in a misconfigured Nginx environment to supply an arbitrary IP address. This manipulation lets the attacker bypass the endpoint rate‑limiting controls built into Ghost, potentially enabling a denial‑of‑service attack or repeated requests. The weakness resides in improper handling of forwarded‑for information and is identified as CWE‑348.

Any Ghost‑CLI deployment using a version earlier than 1.30.1 that is exposed behind an Nginx proxy configured with the $proxy_add_x_forwarded_for directive. The vulnerability affects self‑hosted instances of Ghost‑CLI, particularly those relying on Ghost’s internal rate‑limiting settings.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of less than 1 % suggests there is a very low probability that the vulnerability has been publicly exploited, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, unauthenticated, through crafted HTTP requests directed at the Ghost‑CLI endpoint intercepted by a misconfigured Nginx proxy. Successful exploitation requires the attacker to control the X‑Forwarded‑For header chain; this can be achieved by appending values via $proxy_add_x_forwarded_for, thereby spoofing the client IP address used by Ghost for rate‑limiting enforcement.