PT-2026-21371 · Wallos · Wallos

Acorzo1983 · Publicado 2026-02-21 · Atualizado 2026-02-21 · CVE-2026-27479

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wallos versions 4.6.0 and below

Description Wallos is a self-hostable personal subscription tracker susceptible to a Server-Side Request Forgery (SSRF) issue in the subscription and payment logo/icon upload functionality. The application validates the IP address of a provided URL, but allows HTTP redirects, enabling an attacker to bypass IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function uses FILTER FLAG NO PRIV RANGE | FILTER FLAG NO RES RANGE to validate the URL, but the cURL request is configured with CURLOPT FOLLOWLOCATION = true and CURLOPT MAXREDIRS = 3, allowing redirects without re-validation of the destination IP.

Recommendations Update to version 4.6.1 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-27479

GHSA-FGMF-7G5V-JMJG

Produtos afetados

Wallos

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27479.json · Exploit
• https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg · Aviso do Fabricante
• https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960 · Correção
• https://github.com/ellite/Wallos/releases/tag/v4.6.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27479 · Nota de Segurança
• https://t.me/CVEtracker/45361 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2025180616140919016 · Publicação no Twitter
• https://t.me/cveNotify/152712 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2025154168889962556 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27479 · Aviso do Fabricante