CVE-2026-28680

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

Score

CVSS 3.1 9.3 Critical

Status

Analyzed - security-advisories@github.com

Published

2026-03-06

Last modified

2026-03-06

Weaknesses

CWE-918

Affected products

• Ghostfolio (Ghostfol)
• Ghostfolio (Ghostfolio)

References

• https://github.com/ghostfolio/ghostfolio/releases/tag/2.245.0
• https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-hhv6-c34h-pwgh