CVE-2026-28680 — Ghostfolio: Full-Read SSRF in Manual Asset Import
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing …
Published: 2026-03-06 · CVSS: 9.3 · CVSS 3.1
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7