CVE-2026-28680CWE-918

Ghostfolio: Full-Read SSRF in Manual Asset Import

Critical · published March 6, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
28.8
In the wild
Unconfirmed
What it is

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00362 · 28.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-06T04:26Z
EPSS history
Timeline
  • 06 MAR 04:26Z
    Ghostfolio: Full-Read SSRF in Manual Asset Import
    cvelistv5