Wallos vulnerabilities

15 known vulnerabilities in Wallos from Ellite. 15 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Wallos: Unintended Proxy or Intermediary

  CVE-2026-77348Aug 31, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_

• 8.1 High severity

  Wallos: Improper Authentication

  CVE-2026-61641Aug 31, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the Id

• 8.5 High severity

  Wallos: Server-Side Request Forgery

  CVE-2026-61640Aug 31, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike l

• 8.5 High severity

  Wallos: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-61639Aug 31, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpo

• 8.2 High severity

  Wallos: Server-Side Request Forgery

  CVE-2026-61638Aug 31, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-su

• 8.2 High severity

  Wallos: Improper Authentication

  CVE-2026-54600Aug 31, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can repla

• 7.5 High severity

  Wallos: Cross-Site Request Forgery

  CVE-2026-54599Aug 31, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state aga

• 7.5 High severity

  Wallos: Missing Authentication for Critical Functionality

  CVE-2026-54598Aug 31, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migrati

• 7.7 High severity

  Wallos: Server-Side Request Forgery

  CVE-2026-41688May 7, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 1

• 7.1 High severity

  Wallos is an open-source, self-hostable personal subscription tracker.

  CVE-2026-33417Mar 24, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A pas

• 9.1 Critical severity

  Wallos: Server-Side Request Forgery

  CVE-2026-33407Mar 24, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs

• 7.7 High severity

  Wallos: Server-Side Request Forgery

  CVE-2026-33399Mar 24, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validate_webhook_url_for_ssrf() protection was added to the test* noti

• 8.8 High severity

  Wallos: Improper Certificate Validation

  CVE-2026-30840Mar 7, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notification testers. This issue has been patched in version 4.6.2.

• 7.5 High severity

  Wallos: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-30828Mar 7, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2.

• 7.7 High severity

  Wallos: Server-Side Request Forgery

  CVE-2026-27479Feb 21, 2026Ellite

  Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address