CVE-2026-28680
CRITICALGhostfolio <2.245.0 - SSRF
Title source: llmDescription
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.
Scores
CVSS v3
9.3
EPSS
0.0003
EPSS Percentile
8.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Classification
CWE
CWE-918
Status
draft
Timeline
Published
Mar 06, 2026
Tracked Since
Mar 06, 2026