Ghostfolio is an open source wealth management software.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 6, 2026 · NIST NVD

   Detected

   Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL commands via the getHistorical() method, potentially allowing them to read, modify, or delete sensitive financial data for all users in the database. This issue has been patched in version 2.244.0.

2. Jun 17, 2026 · NIST NVD

   Updated

   Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL commands via the getHistorical() method, potentially allowing them to read, modify, or delete sensitive financial data for all users in the database. This issue has been patched in version 2.244.0.

Affected

• cpe ghostfol/ghostfolioversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-28785

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-28785

  Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL commands via the getHistorical() method, potentially allowing them to read, modify, or delete sensitive financial data for all

  nvd.nist.gov

References

• Product · github.com
• Mitigation · github.com