PT-2026-38445 · Ellite · Wallos

Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-41688

NVD

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41688

Affected Products

Wallos

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-41688 · Security Note
• https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef · Note
• https://github.com/ellite/Wallos/security/advisories/GHSA-h4g7-xv3v-q73g · Note