A time‑based blind SQL injection exists in the getHistorical() method used during manual asset import. By bypassing symbol validation, an attacker can inject and execute arbitrary SQL statements, allowing them to read, modify, or delete financial data belonging to all users. The vulnerability is a direct result of CWE‑89 and is rated with a high severity of 9.3 on the CVSS scale.

The issue affects all releases of Ghostfolio prior to version 2.244.0, including the open‑source wealth management platform sold under the ghostfolio:ghostfolio vendor product.

The exploit probability is very low (EPSS < 1 %) yet the potential impact is severe, and Ghostfolio is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker would need access to the web interface that triggers getHistorical(), typically as a user who can initiate a manual asset import. The attack is inferred to occur through the web API, requiring the ability to submit the asset symbol field that is not properly validated.