CVE-2026-28680

CRITICAL
2026-03-06 [email protected]
9.3
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
Patch Released
Mar 10, 2026 - 19:53 nvd
Patch available
CVE Published
Mar 06, 2026 - 05:16 nvd
CRITICAL 9.3

Tags

SSRF Ghostfolio

Description

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

Analysis

SSRF in Ghostfolio wealth management before 2.245.0. Patch available.

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Identify all Ghostfolio instances and their version numbers; disable the manual asset import feature if version is below 2.245.0. Within 7 days: Upgrade all Ghostfolio deployments to version 2.245.0 or later; review cloud metadata access logs and internal network access logs for suspicious activity. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

47
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +46
POC: 0

Share

CVE-2026-28680 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy