CVE-2026-28785 Ghostfolio: Time-Based Blind SQL Injection in Manual Asset Import
Attackers can execute arbitrary SQL commands via manual asset import to read, modify, or delete sensitive financial data for all users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28785?
CVE-2026-28785 is a critical SQL injection vulnerability in ghostfolio, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL commands via the getHistorical() method, potentially allowing them to read, modify, or delete sensitive financial data for all users in the database. This issue has been patched in version 2.244.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-28785?
It affects 1 product.
Products include Ghostfol Ghostfolio.
How do I fix CVE-2026-28785?
No fix has been published for CVE-2026-28785 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-28785 being exploited?
There is no known exploitation of CVE-2026-28785 in the wild and no public exploit code.
Other vulnerabilities in ghostfolio
Sources
Also known as GHSA-m5cc-7jw5-34xp.