CVE-2026-28680

Published March 6th, 2026

View on NVD ↗

CVSS v3

9.3

CRITICAL

CVSS v2

N/A

Affected

PROJECT

Description

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

ghostfolio/ghostfolio

Open Source Wealth Management Software. Angular + NestJS + Prisma + Nx + TypeScript 🤍

GitHub

8.67K