PT-2026-23825 · Wallos · Wallos

Aryma-F4 · Published 2026-03-07 · Updated 2026-03-11 · CVE-2026-30840

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.6.2

Description Wallos is a self-hostable personal subscription tracker. A server-side request forgery condition exists in the notification testers functionality. This allows for potentially malicious requests to be made on the server.

Recommendations Update to version 4.6.2 or later.

Exploit

Fix

SSRF

Improper Certificate Validation

Weakness Enumeration

CWE-918

CWE-295

Related Identifiers

CVE-2026-30840

GHSA-MR2C-PRQV-HQM8

Affected Products

Wallos

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30840.json · Exploit
• https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d · Patch
• https://github.com/ellite/Wallos/security/advisories/GHSA-mr2c-prqv-hqm8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30840 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30840 · Vendor Advisory
• https://github.com/ellite/Wallos/releases/tag/v4.6.2 · Note
• https://twitter.com/cyberbivash/status/2030197805160050780 · Twitter Post
• https://twitter.com/CveFindCom/status/2030172008219107357 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030183646099812668 · Twitter Post
• https://twitter.com/CVEnew/status/2030339347783041334 · Twitter Post
• https://twitter.com/TheHackerWire/status/2030193439225303130 · Twitter Post
• https://t.me/CVEtracker/46700 · Telegram Post
• https://t.me/cveNotify/155155 · Telegram Post