CVE-2026-28680

Ghostfolio: Full-Read SSRF in Manual Asset Import

State: Published
Severity: 9.3 Critical
Published: Mar 6, 2026
Updated: Mar 6, 2026
Reserved: Mar 2, 2026

Description

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
ghostfolioghostfolio	< 2.245.0Affected

References

https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-hhv6-c34h-pwgh
https://github.com/ghostfolio/ghostfolio/releases/tag/2.245.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.