CVE-2026-28680

9.3 criticalEPSS 0.2%

Critical (9.3) in ghostfol ghostfolio. EPSS 0.2% chance of exploitation in the next 30 days.

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

Severity

CVSS 3.1

9.3 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-03-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ghostfol:ghostfolio

References

https://github.com/ghostfolio/ghostfolio/releases/tag/2.245.0
https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-hhv6-c34h-pwgh

Check your stack JSON