CVE-2026-28680

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.

• CWE-918

• https://github.com/ghostfolio/ghostfolio/releases/tag/2.245.0Product, Release Notes
• https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-hhv6-c34h-pwghMitigation, Patch, Vendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28675OpenSift is an AI study tool that sifts through large datase…5.3
• CVE-2026-28676OpenSift is an AI study tool that sifts through large datase…8.8
• CVE-2026-28677OpenSift is an AI study tool that sifts through large datase…8.2
• CVE-2026-28678Rejected reason: Further research determined the issue is no…
• CVE-2026-28679Home-Gallery.org is a self-hosted open-source web gallery to…7.5
• CVE-2026-2868The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecos…6.4
• CVE-2026-28681Internet Routing Registry daemon version 4 is an IRR databas…8.1
• CVE-2026-28682Gokapi is a self-hosted file sharing server with automatic e…6.4
• CVE-2026-28683Gokapi is a self-hosted file sharing server with automatic e…8.7
• CVE-2026-28684python-dotenv reads key-value pairs from a .env file and can…6.6
• CVE-2026-28685Kimai is a web-based multi-user time-tracking application. P…6.5
• CVE-2026-28686ImageMagick is free and open-source software used for editin…6.8