Wallos CVE-2026-61639

Exploitation requires valid administrator-level credentials to the Wallos application - the restore endpoint is an authenticated admin function and not accessible to regular users or unauthenticated visitors. The database restore feature (POST /endpoints/db/restore.php) must be reachable from the attacker's network position; self-hosted instances behind a firewall with no internet exposure reduce the network-accessible attack surface. The web server process must have write permissions to the webroot or a directory within it; a hardened deployment running the PHP process with minimal filesystem permissions could prevent the webshell write even if path traversal is triggered. No special non-default configuration is required - the vulnerable code path is part of the standard restore workflow available to any authenticated admin.

The CVSS 4.0 base score of 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) accurately reflects the attack profile: network-reachable, no interaction or special attack conditions, but requiring administrator-level credentials (PR:H). This significantly limits the exploitable population to users who have compromised or possess valid admin accounts. Real-world risk is conditional on admin credential exposure - the technique itself is trivial once access is obtained, as Zip Slip exploits require no advanced tooling. EPSS data is not provided; without KEV listing or POC, broad opportunistic exploitation is unlikely, but insider threat or post-credential-compromise scenarios are realistic. The webshell write-to-webroot outcome means successful exploitation yields full RCE on the hosting server, making the impact severe if the prerequisite is met. Self-hosted deployments on shared infrastructure amplify lateral movement risk. Overall: real but bounded - priority for environments where admin accounts may be shared or weakly protected.

An attacker who has obtained administrator credentials to a Wallos instance (via phishing, credential stuffing, or insider access) constructs a ZIP archive containing a PHP webshell at entry path logos/../../endpoints/shell.php. They POST this archive to /endpoints/db/restore.php; the server extracts it without path sanitization, writing the webshell into the application's endpoints directory. The attacker then issues HTTP requests to the webshell URL to execute arbitrary OS commands on the host server. No public proof-of-concept has been identified, but the technique is standard and well-documented in Zip Slip literature.