CVE-2026-28680criticalCWE-918

CVE-2026-28680: critical vulnerability in ghostfolio

Ghostfolio: Full-Read SSRF in Manual Asset Import

Published

Follow this CVE+ Monitor ghostfolio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.3%
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Affected products
ghostfolio · ghostfolio
Related CVEs — ghostfolio

In the same product, most dangerous first.

CVE-2026-59708HIGHGhostfolio - Unauthorized Portfolio Data Exposure via Public EndpointEPSS 0.6%CVE-2026-28785CRITICALGhostfolio: Time-Based Blind SQL Injection in Manual Asset ImportEPSS 0.4%CVE-2026-47127MEDIUMGhostfolio has a Stripe subscription bypassEPSS 0.3%