appstore/apps/wealthfolio

Wealthfolio

产品介绍

Wealthfolio 是面向个人投资者的自托管投资组合跟踪器，可管理账户、持仓、交易、收益、目标和资产配置。数据保存在本地 SQLite 数据库中。

主要功能

• 管理投资账户、持仓、交易和现金流
• 计算投资组合表现、收益和资产配置
• 跟踪财务目标和投资限制
• 通过 CSV 导入及导出本地数据

访问说明

安装后通过 http://<服务器 IP>:<端口> 访问，使用安装时由 1Panel 生成的登录密码。应用没有用户名字段。

本包默认启用上游密码认证。初始化脚本在安装期间启动同一固定 Wealthfolio 镜像的临时容器，从 Alpine 官方仓库安装 argon2，再由标准输入接收密码并生成 Argon2id PHC 哈希。运行中的应用容器只接收哈希，不接收明文登录密码；临时容器生成哈希后立即删除。首次安装和更新密码需要能够访问 Alpine 软件仓库。

1Panel 仍会把随机明文登录密码保存在应用 .env 中，拥有 1Panel 配置读取权限的人可以读取它。不要复用其他系统密码，并限制 1Panel、Docker 和应用目录权限。

应用镜像只提供 HTTP。财务数据不应通过明文公网连接访问：生产环境必须使用可信反向代理终止 HTTPS，并阻止公网直接访问应用端口。默认禁用 MCP 接口。

数据持久化

APP_DATA_DIR 挂载到容器 /data，保存 wealthfolio.db 和应用密钥文件。路径必须位于版本目录内，默认为 ./data；初始化脚本拒绝绝对路径和目录逃逸。升级、迁移或卸载前请备份，卸载不会删除绑定目录中的数据。

WF_SECRET_KEY 用于派生会话签名和静态秘密加密密钥。1Panel 会随机生成输入；初始化脚本把不符合上游 32 字节格式的输入确定性规范化，并写回 .env，后续升级不得更换，否则已加密秘密可能无法解密。

安全与漏洞警告

• 2026-07-28 对固定镜像的 fresh Trivy 扫描结果为 0 Critical / 2 High。两个记录分别属于 musl 和 musl-utils，但都对应同一个 CVE-2026-40200。
• 该漏洞是 musl qsort 在极大数组上的栈内存破坏。32 位平台约需超过 700 万个元素；本包只支持 64 位 amd64/arm64，而 64 位触发条件需要超过第 64 个 Leonardo 数量级，实际不可分配。默认应用路径没有可由请求直接控制的 libc qsort 超大数组入口，因此评估为默认不可实际触发；仍应在官方修复镜像发布后重新验证并尽快升级。
• 启动入口以 root 和 CHOWN、DAC_OVERRIDE、SETUID、SETGID capabilities 穿越并校正持久化数据目录权限，只提取并严格校验凭据文件中的两个固定值，不执行文件内容，随后立即降为 UID/GID 1000:1000。最终应用进程有效和允许 capabilities 均为零，并启用 no-new-privileges；bounding set 仍包含四个启动能力，但进程没有允许能力且不能获得新权限。根文件系统只读，只有 /data 和带 nodev,noexec,nosuid 的 /tmp 可写。
• 登录接口保留上游每 IP 每 60 秒 5 次请求的限速。只向可信用户开放，使用 HTTPS，定期备份，并关注上游更新。任何后续 Critical 发现都会阻止发布。

Introduction

Wealthfolio is a self-hosted investment portfolio tracker for accounts, holdings, transactions, performance, goals, and allocation. It persists its data in a local SQLite database.

Features

• Manage investment accounts, holdings, transactions, and cash flows
• Calculate portfolio performance, returns, and allocation
• Track financial goals and investment limits
• Import and export local data through CSV workflows

Access And Authentication

Open http://<server-ip>:<port> and sign in with the random password generated by 1Panel during installation. The application has no username field.

Password authentication is enabled by default. During installation, the init script starts an ephemeral container from the same pinned Wealthfolio image, installs argon2 from the official Alpine repository, passes the password over standard input, and writes an Argon2id PHC hash. The running application receives only that hash. The helper container is removed immediately. Initial installation and password changes therefore require access to the Alpine package repository.

1Panel retains the random plaintext login password in the app .env. Anyone who can read 1Panel configuration can recover it. Do not reuse the password, and restrict access to 1Panel, Docker, and the application directory.

The image serves HTTP only. Do not expose financial data over an unencrypted public connection. Terminate HTTPS at a trusted reverse proxy and block public access to the direct app port. The MCP endpoint is disabled by default.

APP_DATA_DIR persists /data, including wealthfolio.db and application key material. It must stay within the version directory and defaults to ./data; absolute and escaping paths are rejected. Back it up before upgrades or migration. Uninstall does not remove bind-mounted data.

WF_SECRET_KEY derives session-signing and secrets-at-rest keys. 1Panel generates its input; init deterministically normalizes values that are not already valid 32-byte keys and writes the result back to .env. Do not change it during later upgrades, or previously encrypted secrets may become unreadable.

Security And Vulnerability Warning

• A fresh Trivy scan of the pinned image on 2026-07-28 reports 0 Critical / 2 High. The two package records are musl and musl-utils, both for the same CVE-2026-40200.
• The issue is stack corruption in musl qsort for extremely large arrays. A 32-bit trigger needs roughly seven million elements; this package supports only 64-bit amd64/arm64, where exploitation requires exceeding the 64th Leonardo-number scale and is not practically allocatable. No default request path directly controls such a libc qsort input. Treat it as not practically reachable by the default service, but revalidate and upgrade promptly when an official fixed image is published.
• A short root entrypoint uses CHOWN, DAC_OVERRIDE, SETUID, and SETGID to traverse and align persistent data-directory ownership. It extracts and strictly validates only the two expected credential values without executing file contents, then immediately drops to UID/GID 1000:1000. The final application process has zero effective and permitted capabilities and no-new-privileges; its bounding set still contains the four startup capabilities, but it has no permitted set and cannot gain new privileges. The root filesystem is read-only, and only /data and a nodev,noexec,nosuid /tmp are writable.
• Upstream login rate limiting remains at five attempts per IP per 60 seconds. Restrict access to trusted users, enforce HTTPS, maintain backups, and follow upstream updates. Any future Critical finding blocks release.

References

• Project, source, and license: https://github.com/wealthfolio/wealthfolio/tree/v3.6.2
• Official self-hosting documentation: https://github.com/wealthfolio/wealthfolio/blob/v3.6.2/docs/self-host/README.md
• Official Compose: https://github.com/wealthfolio/wealthfolio/blob/v3.6.2/compose.yml
• Release: https://github.com/wealthfolio/wealthfolio/releases/tag/v3.6.2
• musl advisory: https://www.cve.org/CVERecord?id=CVE-2026-40200