← Database

CVE-2026-28680

CRITICAL CVSS: 9.3 Published: 2026-03-06 Modified: 2026-06-17

Description

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

Affected Platforms

Ghostfol Ghostfolio

Weakness Type

CWE-918

References