CVE-2026-28785 is a critical (CVSS 9.8) SQL injection in Ghostfolio, the open source wealth management app, in versions before 2.244.0. By bypassing symbol validation, an attacker can run SQL through getHistorical(). Upgrade to 2.244.0, and consider turning off public signup.
What's affected
The GitHub advisory lists Ghostfolio (Docker Hub image ghostfolio/ghostfolio) before 2.244.0 as affected. The patched version is 2.244.0.
The advisory titles the issue a time-based blind SQL injection in the manual asset import feature.
How to check if you're exposed
Check the image tag you run:
docker ps --format '{{.Image}}' | grep -i ghostfolio
If you build from source, check the version in package.json. Anything below 2.244.0 needs the upgrade. Also check whether public user signup is enabled.
What to do now
- Upgrade Ghostfolio to 2.244.0 or later and restart the stack.
- Disable public user signup, as the advisory suggests, if you do not need it.
- Back up the database before and after the upgrade.
- Review database logs for odd long-running queries if the app was exposed.
- Rotate secrets for the database user if you suspect data access.
Why it matters
This is CWE-89, SQL injection. The advisory says that by bypassing symbol validation an attacker can reach arbitrary SQL, which could read, change or delete financial data for all users in the database.
What stands out is the scope. A single multi-user database means one injection exposes everyone's portfolio data, not only the attacker's account. That is why the advisory lists limiting signup as a workaround: it narrows who can reach the import feature.
The record does not mark this CVE as exploited in the wild.
Quick check
Does disabling signup fix the bug?
No. It reduces who can reach the vulnerable import feature, which is a useful stopgap. The fix is upgrading to 2.244.0.
Sources
Last reviewed: 19 October 2026.
