Ellite
Monthly
Incomplete patch coverage in Wallos, the self-hosted subscription tracker, leaves a second unauthenticated logo-search endpoint (`endpoints/payments/search.php`) vulnerable to SSRF via HTTP proxy header injection - an oversight from the fix for CVE-2026-33407. Wallos prior to 5.0.0 passes the `HTTP_PROXY`/`HTTPS_PROXY` environment variable directly into cURL's `CURLOPT_PROXY`, allowing any unauthenticated network attacker to force the server's outbound HTTP requests through an attacker-controlled proxy. No active exploitation is confirmed (not in CISA KEV) and no public POC is referenced in available data, but the attack requires no credentials and no special configuration.
Full account takeover in Wallos 4.0.0-4.9.5 is possible via OIDC authentication bypass when the application links an incoming OIDC identity to an existing local account using only the email claim, ignoring whether the IdP marked that email as verified via the `email_verified` flag. An attacker operating on a multi-tenant or open-registration IdP trusted by the target Wallos instance can claim the administrator's email, trigger the OIDC login flow, and be granted full admin access with no password or prior Wallos credentials. No public exploit has been identified at time of analysis; the attack complexity is rated High (AC:H) reflecting the IdP-configuration prerequisite.
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct the server to issue arbitrary outbound HTTP requests, including to cloud provider metadata services and internal network hosts. All Wallos releases prior to 4.9.6 are affected; the OIDC callback handler at includes/oidc/handle_oidc_callback.php:18-49 passes admin-supplied token_url and user_info_url directly to curl_init() without the validate_webhook_url_for_ssrf() protection already applied to logo and webhook URL fields. No public exploit has been identified at time of analysis, and a confirmed vendor patch is available in v4.9.6 released 2026-06-22.
Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary files - including PHP webshells - directly into the application webroot. The flaw exists in POST /endpoints/db/restore.php, where ZipArchive::extractTo() processes ZIP entries without sanitizing ../ sequences, enabling directory escape before any extension-based filtering runs. An admin who uploads a crafted ZIP with an entry like logos/../../endpoints/shell.php achieves remote code execution on the server. No public exploit or CISA KEV listing has been identified at time of analysis; however, the technique is well-understood and the attack is low-complexity once admin credentials are held.
Server-side request forgery in Wallos prior to version 4.9.6 enables authenticated users to force the server's PHPMailer instance to connect to any attacker-specified host and port by supplying crafted smtpaddress and smtpport values to the test email notification endpoint. The flaw is a coverage gap - every other notification endpoint applies the application's ssrf_helper.php guard, but testemailnotifications.php was omitted. An authenticated attacker can probe internal network services and query cloud metadata APIs such as AWS IMDSv1, potentially harvesting cloud credentials. No public exploit or CISA KEV listing is identified at time of analysis; a vendor patch is available as v4.9.6.
Wallos prior to 4.9.4 exposes its database import endpoint at endpoints/db/import.php with no authentication, allowing a remote unauthenticated attacker to fully replace the application's SQLite database on any fresh or unconfigured instance. The sole guard - a user-table row count of zero - is a setup-state check, not a security control, meaning any newly deployed Wallos instance is vulnerable before the first administrator account is created. No public exploit has been identified at time of analysis, and the issue is patched in v4.9.4 (use v4.9.5, as the v4.9.4 container image is broken).
OIDC login CSRF in Wallos prior to 4.9.4 allows a remote unauthenticated attacker to log a victim into the attacker's own account by tricking them into visiting a crafted callback URL. The root cause is that checksession.php processes the OIDC authorization callback without validating the state parameter against the session-stored nonce generated in login.php, breaking the OIDC CSRF protection mechanism entirely. No public exploit has been identified at time of analysis, but the attack requires only that the victim use OIDC login and click a malicious link, making it low-friction for a motivated attacker.
Unauthenticated remote execution of database schema migrations in Wallos prior to version 4.9.4 allows any attacker with HTTP access to trigger pending SQLite migration files against the live database by calling endpoints/db/migrate.php directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires zero authentication, zero complexity, and no user interaction against default-configured instances. No public exploit has been identified at time of analysis, but the trivial attack surface makes this a straightforward integrity threat to any internet-exposed Wallos deployment.
DNS rebinding bypass in Wallos subscription tracker allows authenticated users to exfiltrate internal network data via SSRF on 10 of 11 HTTP endpoints. Wallos 4.8.4 and prior validate webhook URLs with gethostbyname() but fail to pin DNS resolution in cURL requests, creating a time-of-check-time-of-use race window. Attackers with low-privilege accounts can exploit this to probe internal services (databases, cloud metadata endpoints, admin panels) despite SSRF defenses. EPSS not yet available for this recent CVE. No vendor-released patch at time of analysis - upstream commit e87387f0 exists but tagged release version not confirmed.
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 4.7.0 that allows authenticated users to access internal network services, cloud metadata endpoints, and localhost-bound services. The vulnerability exists in three unprotected attack surfaces: the AI Ollama host parameter, the AI recommendations endpoint, and the notification cron job-areas that were missed when SSRF protections were partially implemented in an earlier patch (CVE-2026-30840). An attacker with valid credentials can leverage these endpoints to reach sensitive internal resources including AWS IMDSv1, GCP, and Azure metadata services.
An incomplete Server-Side Request Forgery (SSRF) mitigation in Wallos, a self-hostable subscription tracker, allows authenticated attackers to bypass security controls and force the application to make requests to internal or private IP addresses. Wallos versions prior to 4.7.0 are affected. The vulnerability occurs because SSRF validation was added to test notification endpoints but not the corresponding save endpoints, enabling attackers to store malicious URLs that execute without validation when the cron job runs. No active exploitation (KEV) or public POC is currently documented.
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability in the endpoints/logos/search.php endpoint prior to version 4.7.0. The vulnerability allows unauthenticated attackers to hijack HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling them to redirect outbound requests to arbitrary domains by manipulating DNS resolution through user-supplied search terms. This attack requires no special privileges and can be executed remotely over the network, making it a significant risk for exposed Wallos instances.
iCalendar injection in Wallos prior to v5.0.0 allows authenticated users to break out of VEVENT blocks in exported .ics feeds by embedding raw CRLF sequences in subscription names or notes, enabling insertion of fully attacker-controlled calendar events - including spoofed organizers and arbitrary ATTENDEE email addresses - into any calendar application subscribed to the feed. The root cause is a validation/export mismatch: input sanitization encodes HTML metacharacters but never strips newlines, while the iCal export layer decodes those entities back before writing output, letting CRLF pass through unmodified. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor-released patch is v5.0.0.
Server-side request forgery in Wallos (versions 2.0.0 through 4.x) lets any authenticated user force the application server to open arbitrary outbound TCP connections to attacker-chosen hosts, including internal and link-local addresses. The per-user SMTP notification settings endpoint stores a user-supplied host without validation, and the notification cron job passes it directly to PHPMailer - no admin rights are required to abuse this path. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patched this in version 5.0.0.
Server-Side Request Forgery in Wallos prior to version 5.0.0 allows any authenticated low-privileged user to store an arbitrary SMTP host - including private RFC 1918 addresses and cloud metadata endpoints - in their personal email notification settings without server-side validation. When the scheduled notification cron job fires, the Wallos server opens an outbound TCP connection to the attacker-specified address, giving the attacker a reliable blind SSRF primitive to probe internal network services from the server's network vantage point. No public exploit is identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
Incorrect authorization in Wallos prior to version 4.9.1 allows any authenticated user to consume another user's third-party currency API credentials. The endpoint endpoints/currency/update_exchange.php selects the first Fixer or API Layer provider key stored globally rather than scoping it to the requesting user, meaning a user without their own API key can trigger exchange-rate refreshes that exhaust a different user's API quota. No public exploit has been identified at time of analysis, and the vendor-released patch (v4.9.1) resolves the cross-user data isolation flaw.
Cross-user data isolation failure in Wallos prior to v4.9.1 allows authenticated users to infer the monthly-normalized subscription cost belonging to other users on the same instance. By setting replacement_subscription_id on their own inactive subscription to a victim's subscription ID, an attacker causes Wallos's stats aggregation engine to dereference the foreign record without user_id scoping, leaking derived financial metadata. A vendor-released patch is available in v4.9.1; no public exploit or CISA KEV listing has been identified at time of analysis.
Wallos versions 4.8.4 and prior allow authenticated users to bypass webhook URL restrictions and send server-side requests to administrator-allowlisted internal targets by reusing the global allowlist for individual user webhooks. This enables Server-Side Request Forgery (SSRF) to internal automation services that may expose deployment or execution APIs, potentially leading to remote code execution on downstream systems. No public exploit code identified at time of analysis, and no vendor-released patch is available.
Blind SSRF via CGNAT address bypass in Wallos prior to version 4.8.1 allows authenticated users to probe internal services on Carrier-Grade NAT networks (100.64.0.0/10) through logo/icon URL fetching in subscription and payment endpoints. The vulnerability stems from incomplete IP range validation that fails to block RFC 6598 CGNAT addresses, enabling reconnaissance of services in Tailscale, dual-stack carrier environments, and internal infrastructure. CVSS 4.3 reflects limited confidentiality impact with authentication requirement; actively fixed in 4.8.1.
Wallos, an open-source self-hostable subscription tracker, contains an authentication bypass vulnerability in its password reset mechanism where reset tokens never expire. Versions prior to 4.7.2 are affected, allowing attackers who intercept a password reset link to use it indefinitely days, weeks, or months after generation. An attacker exploiting this vulnerability can gain unauthorized account access and potentially modify subscription data, though the CVSS score of 6.5 reflects moderate real-world risk due to the required interception precondition.
A stored cross-site scripting (XSS) vulnerability exists in Wallos versions prior to 4.7.0 within the payment method rename endpoint that allows authenticated users to inject arbitrary JavaScript code. When any user visits the Settings, Subscriptions, or Statistics pages, the injected malicious script executes in their browser context. This vulnerability is compounded by the wallos_login authentication cookie lacking the HttpOnly flag, enabling attackers to steal session tokens and achieve full account compromise through session hijacking.
Incomplete patch coverage in Wallos, the self-hosted subscription tracker, leaves a second unauthenticated logo-search endpoint (`endpoints/payments/search.php`) vulnerable to SSRF via HTTP proxy header injection - an oversight from the fix for CVE-2026-33407. Wallos prior to 5.0.0 passes the `HTTP_PROXY`/`HTTPS_PROXY` environment variable directly into cURL's `CURLOPT_PROXY`, allowing any unauthenticated network attacker to force the server's outbound HTTP requests through an attacker-controlled proxy. No active exploitation is confirmed (not in CISA KEV) and no public POC is referenced in available data, but the attack requires no credentials and no special configuration.
Full account takeover in Wallos 4.0.0-4.9.5 is possible via OIDC authentication bypass when the application links an incoming OIDC identity to an existing local account using only the email claim, ignoring whether the IdP marked that email as verified via the `email_verified` flag. An attacker operating on a multi-tenant or open-registration IdP trusted by the target Wallos instance can claim the administrator's email, trigger the OIDC login flow, and be granted full admin access with no password or prior Wallos credentials. No public exploit has been identified at time of analysis; the attack complexity is rated High (AC:H) reflecting the IdP-configuration prerequisite.
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct the server to issue arbitrary outbound HTTP requests, including to cloud provider metadata services and internal network hosts. All Wallos releases prior to 4.9.6 are affected; the OIDC callback handler at includes/oidc/handle_oidc_callback.php:18-49 passes admin-supplied token_url and user_info_url directly to curl_init() without the validate_webhook_url_for_ssrf() protection already applied to logo and webhook URL fields. No public exploit has been identified at time of analysis, and a confirmed vendor patch is available in v4.9.6 released 2026-06-22.
Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary files - including PHP webshells - directly into the application webroot. The flaw exists in POST /endpoints/db/restore.php, where ZipArchive::extractTo() processes ZIP entries without sanitizing ../ sequences, enabling directory escape before any extension-based filtering runs. An admin who uploads a crafted ZIP with an entry like logos/../../endpoints/shell.php achieves remote code execution on the server. No public exploit or CISA KEV listing has been identified at time of analysis; however, the technique is well-understood and the attack is low-complexity once admin credentials are held.
Server-side request forgery in Wallos prior to version 4.9.6 enables authenticated users to force the server's PHPMailer instance to connect to any attacker-specified host and port by supplying crafted smtpaddress and smtpport values to the test email notification endpoint. The flaw is a coverage gap - every other notification endpoint applies the application's ssrf_helper.php guard, but testemailnotifications.php was omitted. An authenticated attacker can probe internal network services and query cloud metadata APIs such as AWS IMDSv1, potentially harvesting cloud credentials. No public exploit or CISA KEV listing is identified at time of analysis; a vendor patch is available as v4.9.6.
Wallos prior to 4.9.4 exposes its database import endpoint at endpoints/db/import.php with no authentication, allowing a remote unauthenticated attacker to fully replace the application's SQLite database on any fresh or unconfigured instance. The sole guard - a user-table row count of zero - is a setup-state check, not a security control, meaning any newly deployed Wallos instance is vulnerable before the first administrator account is created. No public exploit has been identified at time of analysis, and the issue is patched in v4.9.4 (use v4.9.5, as the v4.9.4 container image is broken).
OIDC login CSRF in Wallos prior to 4.9.4 allows a remote unauthenticated attacker to log a victim into the attacker's own account by tricking them into visiting a crafted callback URL. The root cause is that checksession.php processes the OIDC authorization callback without validating the state parameter against the session-stored nonce generated in login.php, breaking the OIDC CSRF protection mechanism entirely. No public exploit has been identified at time of analysis, but the attack requires only that the victim use OIDC login and click a malicious link, making it low-friction for a motivated attacker.
Unauthenticated remote execution of database schema migrations in Wallos prior to version 4.9.4 allows any attacker with HTTP access to trigger pending SQLite migration files against the live database by calling endpoints/db/migrate.php directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires zero authentication, zero complexity, and no user interaction against default-configured instances. No public exploit has been identified at time of analysis, but the trivial attack surface makes this a straightforward integrity threat to any internet-exposed Wallos deployment.
DNS rebinding bypass in Wallos subscription tracker allows authenticated users to exfiltrate internal network data via SSRF on 10 of 11 HTTP endpoints. Wallos 4.8.4 and prior validate webhook URLs with gethostbyname() but fail to pin DNS resolution in cURL requests, creating a time-of-check-time-of-use race window. Attackers with low-privilege accounts can exploit this to probe internal services (databases, cloud metadata endpoints, admin panels) despite SSRF defenses. EPSS not yet available for this recent CVE. No vendor-released patch at time of analysis - upstream commit e87387f0 exists but tagged release version not confirmed.
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 4.7.0 that allows authenticated users to access internal network services, cloud metadata endpoints, and localhost-bound services. The vulnerability exists in three unprotected attack surfaces: the AI Ollama host parameter, the AI recommendations endpoint, and the notification cron job-areas that were missed when SSRF protections were partially implemented in an earlier patch (CVE-2026-30840). An attacker with valid credentials can leverage these endpoints to reach sensitive internal resources including AWS IMDSv1, GCP, and Azure metadata services.
An incomplete Server-Side Request Forgery (SSRF) mitigation in Wallos, a self-hostable subscription tracker, allows authenticated attackers to bypass security controls and force the application to make requests to internal or private IP addresses. Wallos versions prior to 4.7.0 are affected. The vulnerability occurs because SSRF validation was added to test notification endpoints but not the corresponding save endpoints, enabling attackers to store malicious URLs that execute without validation when the cron job runs. No active exploitation (KEV) or public POC is currently documented.
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability in the endpoints/logos/search.php endpoint prior to version 4.7.0. The vulnerability allows unauthenticated attackers to hijack HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling them to redirect outbound requests to arbitrary domains by manipulating DNS resolution through user-supplied search terms. This attack requires no special privileges and can be executed remotely over the network, making it a significant risk for exposed Wallos instances.
iCalendar injection in Wallos prior to v5.0.0 allows authenticated users to break out of VEVENT blocks in exported .ics feeds by embedding raw CRLF sequences in subscription names or notes, enabling insertion of fully attacker-controlled calendar events - including spoofed organizers and arbitrary ATTENDEE email addresses - into any calendar application subscribed to the feed. The root cause is a validation/export mismatch: input sanitization encodes HTML metacharacters but never strips newlines, while the iCal export layer decodes those entities back before writing output, letting CRLF pass through unmodified. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor-released patch is v5.0.0.
Server-side request forgery in Wallos (versions 2.0.0 through 4.x) lets any authenticated user force the application server to open arbitrary outbound TCP connections to attacker-chosen hosts, including internal and link-local addresses. The per-user SMTP notification settings endpoint stores a user-supplied host without validation, and the notification cron job passes it directly to PHPMailer - no admin rights are required to abuse this path. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patched this in version 5.0.0.
Server-Side Request Forgery in Wallos prior to version 5.0.0 allows any authenticated low-privileged user to store an arbitrary SMTP host - including private RFC 1918 addresses and cloud metadata endpoints - in their personal email notification settings without server-side validation. When the scheduled notification cron job fires, the Wallos server opens an outbound TCP connection to the attacker-specified address, giving the attacker a reliable blind SSRF primitive to probe internal network services from the server's network vantage point. No public exploit is identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
Incorrect authorization in Wallos prior to version 4.9.1 allows any authenticated user to consume another user's third-party currency API credentials. The endpoint endpoints/currency/update_exchange.php selects the first Fixer or API Layer provider key stored globally rather than scoping it to the requesting user, meaning a user without their own API key can trigger exchange-rate refreshes that exhaust a different user's API quota. No public exploit has been identified at time of analysis, and the vendor-released patch (v4.9.1) resolves the cross-user data isolation flaw.
Cross-user data isolation failure in Wallos prior to v4.9.1 allows authenticated users to infer the monthly-normalized subscription cost belonging to other users on the same instance. By setting replacement_subscription_id on their own inactive subscription to a victim's subscription ID, an attacker causes Wallos's stats aggregation engine to dereference the foreign record without user_id scoping, leaking derived financial metadata. A vendor-released patch is available in v4.9.1; no public exploit or CISA KEV listing has been identified at time of analysis.
Wallos versions 4.8.4 and prior allow authenticated users to bypass webhook URL restrictions and send server-side requests to administrator-allowlisted internal targets by reusing the global allowlist for individual user webhooks. This enables Server-Side Request Forgery (SSRF) to internal automation services that may expose deployment or execution APIs, potentially leading to remote code execution on downstream systems. No public exploit code identified at time of analysis, and no vendor-released patch is available.
Blind SSRF via CGNAT address bypass in Wallos prior to version 4.8.1 allows authenticated users to probe internal services on Carrier-Grade NAT networks (100.64.0.0/10) through logo/icon URL fetching in subscription and payment endpoints. The vulnerability stems from incomplete IP range validation that fails to block RFC 6598 CGNAT addresses, enabling reconnaissance of services in Tailscale, dual-stack carrier environments, and internal infrastructure. CVSS 4.3 reflects limited confidentiality impact with authentication requirement; actively fixed in 4.8.1.
Wallos, an open-source self-hostable subscription tracker, contains an authentication bypass vulnerability in its password reset mechanism where reset tokens never expire. Versions prior to 4.7.2 are affected, allowing attackers who intercept a password reset link to use it indefinitely days, weeks, or months after generation. An attacker exploiting this vulnerability can gain unauthorized account access and potentially modify subscription data, though the CVSS score of 6.5 reflects moderate real-world risk due to the required interception precondition.
A stored cross-site scripting (XSS) vulnerability exists in Wallos versions prior to 4.7.0 within the payment method rename endpoint that allows authenticated users to inject arbitrary JavaScript code. When any user visits the Settings, Subscriptions, or Statistics pages, the injected malicious script executes in their browser context. This vulnerability is compounded by the wallos_login authentication cookie lacking the HttpOnly flag, enabling attackers to steal session tokens and achieve full account compromise through session hijacking.