PT-2026-21371 · Wallos · Wallos

Acorzo1983 · Published 2026-02-21 · Updated 2026-02-21 · CVE-2026-27479

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wallos versions 4.6.0 and below

Description Wallos is a self-hostable personal subscription tracker susceptible to a Server-Side Request Forgery (SSRF) issue in the subscription and payment logo/icon upload functionality. The application validates the IP address of a provided URL, but allows HTTP redirects, enabling an attacker to bypass IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function uses FILTER FLAG NO PRIV RANGE | FILTER FLAG NO RES RANGE to validate the URL, but the cURL request is configured with CURLOPT FOLLOWLOCATION = true and CURLOPT MAXREDIRS = 3, allowing redirects without re-validation of the destination IP.

Recommendations Update to version 4.6.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27479

GHSA-FGMF-7G5V-JMJG

Affected Products

Wallos

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27479.json · Exploit
• https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg · Vendor Advisory
• https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27479 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27479 · Vendor Advisory
• https://github.com/ellite/Wallos/releases/tag/v4.6.1 · Note
• https://t.me/CVEtracker/45361 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2025180616140919016 · Twitter Post
• https://t.me/cveNotify/152712 · Telegram Post
• https://twitter.com/CVEnew/status/2025154168889962556 · Twitter Post