PT-2026-38445 · Ellite · Wallos

Decsecre583 · Publicado 2026-05-07 · Atualizado 2026-05-07 · CVE-2026-41688

Mitre

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-41688

Produtos afetados

Wallos

Referências · 4

• https://github.com/ellite/Wallos/security/advisories/GHSA-h4g7-xv3v-q73g · Nota
• https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef · Nota
• https://t.me/CVEtracker/52997 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-41688 · Nota de Segurança