Skip to content
OpenAdvisories

Vendor

ghostfolio

5 known vulnerabilities.

Products

ghostfolio 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-28785

    Ghostfolio: Time-Based Blind SQL Injection in Manual Asset Import

    Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL commands via the getHistorical() method, potentially allowing them to read, modify, or delete sensitive fi…

    ghostfolio ghostfolio
  • Critical 9.3
    CVE-2026-28680

    Ghostfolio: Full-Read SSRF in Manual Asset Import

    Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network servi…

    ghostfolio ghostfolio