Ghostfolio’s manual asset import process lacks proper validation on user-supplied URLs, permitting a full‑read SSRF. An attacker can supply a crafted request that forces the server to fetch data from any internal or externally exposed endpoint, including instance metadata services that expose credentials and configuration. This flaw can lead to the exposure of highly sensitive information, compromising confidentiality and potentially enabling further lateral movement.

All installations of Ghostfolio older than version 2.245.0 are vulnerable. The issue is confined to the open‑source product available under the ghostfolio:ghostfolio CNA.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is below 1%, suggesting a low current probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the web UI used for manual asset import; an attacker must have access to the application but does not require elevated privileges. Exploitation would involve providing a malicious URL to the import functionality, resulting in data exfiltration if the target environment hosts services such as cloud metadata endpoints or internal APIs.