Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
Ghostfolio: Unpatched, attackers can steal sensitive data from cloud services
CVE-2026-28680
Summary
The manual asset import feature in Ghostfolio allows attackers to access and steal sensitive information from cloud services, potentially putting your financial data at risk. This issue was fixed in version 2.245.0, so make sure to update your Ghostfolio software. If you haven't already, upgrade to the latest version to protect your data.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| ghostfol | ghostfolio | <= 2.245.0 | – |
Original title
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate s...
Original description
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.
nvd CVSS3.1
9.3
Vulnerability type
CWE-918
Server-Side Request Forgery (SSRF)
Published: 6 Mar 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026