PT-2026-23826 · Wallos · Wallos

Published 2026-03-07 · Updated 2026-03-07 · CVE-2026-30841

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.6.2

Description Wallos is a self-hostable personal subscription tracker. Prior to version 4.6.2, the passwordreset.php script outputs the token and email parameters directly into HTML input value attributes without proper sanitization. Specifically, the script uses and without calling htmlspecialchars(). This allows for reflected Cross-Site Scripting (XSS) by breaking out of the attribute context. The token and email parameters are vulnerable.

Recommendations Update to version 4.6.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30841

GHSA-75HC-FC26-9797

Affected Products

Wallos

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30841.json · Exploit
• https://github.com/ellite/Wallos/security/advisories/GHSA-75hc-fc26-9797 · Vendor Advisory
• https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-30841 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30841 · Vendor Advisory
• https://github.com/ellite/Wallos/releases/tag/v4.6.2 · Note
• https://twitter.com/cyberbivash/status/2030197469372391914 · Twitter Post
• https://t.me/CVEtracker/46701 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2030186206063923468 · Twitter Post
• https://twitter.com/CVEnew/status/2030339346600247753 · Twitter Post