Ghostfolio: Full-Read SSRF in Manual Asset Import

The SSRF vulnerability in Ghostfolio presents a significant risk. An attacker could exploit this flaw to exfiltrate sensitive cloud metadata, such as Instance Metadata Service (IMDS) data from cloud environments. This data often contains credentials and configuration details that could be used to compromise the entire cloud infrastructure. Furthermore, the attacker could use the SSRF to probe internal network services, potentially identifying other vulnerable systems or sensitive data stores within the organization's network. The potential blast radius extends beyond the Ghostfolio instance itself, potentially impacting the entire underlying infrastructure.

Organizations utilizing Ghostfolio for wealth management, particularly those deploying it in cloud environments or with direct access to internal network resources, are at significant risk. Shared hosting environments where Ghostfolio is installed could also be vulnerable, as attackers may be able to exploit the vulnerability through other tenants.

1. 2026-03-06Disclosure

   disclosure

1. Reserviert2026-03-02
2. Veröffentlicht2026-03-06
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-28680 is to immediately upgrade Ghostfolio to version 2.245.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the Ghostfolio server to only necessary services. Implement strict input validation on the manual asset import feature to prevent malicious URLs. Consider using a Web Application Firewall (WAF) with SSRF protection rules to block suspicious requests. Regularly review Ghostfolio's configuration and access controls. After upgrading, confirm the fix by attempting a manual asset import with a known malicious URL and verifying that the request is blocked.