What is the CVSS score of CVE-2026-28785?

CVE-2026-28785 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ghostfolio are affected by CVE-2026-28785?

A critical vulnerability (CVSS 9.8) in Ghostfolio wealth management software could allow attackers to gain unauthorized access to sensitive financial data and user accounts.. A patch is available.

How to fix or mitigate CVE-2026-28785?

Within 24 hours: Identify all instances of Ghostfolio in your environment and assess data sensitivity. Within 7 days: Apply the available vendor patch to all affected systems and verify successful deployment. Within 30 days: Conduct security audit of patched systems and review access logs for signs of exploitation.

Ghostfolio CVE-2026-28785

CRITICAL

SQL Injection (CWE-89)

2026-03-06 security-advisories@github.com

RCE SQLi Ghostfolio

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 10, 2026 - 19:51 nvd

Patch available

CVE Published

Mar 06, 2026 - 05:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL commands via the getHistorical() method, potentially allowing them to read, modify, or delete sensitive financial data for all users in the database. This issue has been patched in version 2.244.0.