Wallos CVE-2026-41687

Attacker must be authenticated to Wallos (PR:L in CVSS vector confirms low-privilege authentication requirement). The target Wallos deployment must be connected to or able to reach a network segment using CGNAT addressing (100.64.0.0/10), such as a Tailscale mesh network, ISP carrier-grade NAT, or internal CGNAT subnets. The subscription or payment endpoints (endpoints/subscription/add.php or endpoints/payments/add.php) must accept user-supplied URLs for logo/icon fields. No special configuration beyond default Wallos installation is required; the vulnerability is present in default code paths. Non-default configurations that disable logo fetching or restrict outbound connectivity would mitigate exploitation. The vulnerability does NOT require unauthenticated access, does NOT require user interaction beyond submitting a form, and does NOT affect confidentiality or integrity of Wallos data itself, only enables reconnaissance of internal networks.

CVSS 4.3 with AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N correctly reflects that this is a network-accessible vulnerability with low attack complexity but requiring low-privilege authentication. Exploitation probability is moderate: CGNAT environments (Tailscale mesh networks, ISP carrier-grade NAT deployments, enterprise dual-stack NAT) are increasingly common, but the vulnerability requires authenticated access, limiting widespread automated exploitation. The blind SSRF aspect means an attacker cannot directly exfiltrate data but can probe service availability, gather version banners via timing/error analysis, or trigger side-channel information disclosure. Patch availability (4.8.1 released) and fix confirmation via commit evidence significantly reduce risk for updated installations. For unpatched Wallos deployments in CGNAT or Tailscale environments with untrusted users, this poses real reconnaissance risk; in isolated networks or with strict user access controls, real-world impact is lower. No EPSS score provided, but KEV status unknown - this appears to be a GitHub-disclosed vulnerability without confirmed active exploitation.

A low-privileged authenticated Wallos user (or one who has compromised user credentials) navigates to the subscription or payment addition form. They enter a logo URL pointing to an internal Tailscale or carrier-grade NAT service: http://100.64.0.5:8080/admin. Wallos passes this URL to cURL for fetching the logo, bypassing SSRF validation because the CGNAT range is not blocked. The attacker observes response timing, HTTP status codes, or error messages to infer whether services are listening at that address, gathering network topology information for further exploitation or lateral movement.