PT-2026-23647 · Unknown · Ghostfolio

Ratrarity · Published 2026-03-06 · Updated 2026-03-11 · CVE-2026-28785

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghostfolio versions prior to 2.244.0

Description Ghostfolio is a wealth management software susceptible to arbitrary SQL command execution. An attacker can bypass symbol validation to execute SQL commands through the getHistorical() method. Successful exploitation could allow an attacker to read, modify, or delete sensitive financial data for all users in the database.

Recommendations Update to version 2.244.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28785

GHSA-M5CC-7JW5-34XP

Affected Products

Ghostfolio

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28785.json · Exploit
• https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-m5cc-7jw5-34xp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28785 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28785 · Vendor Advisory
• https://github.com/ghostfolio/ghostfolio/releases/tag/2.244.0 · Note
• https://t.me/CVEtracker/46554 · Telegram Post
• https://twitter.com/cracbot/status/2031686846712074750 · Twitter Post