Vulnerability Description
Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wallosapp | Wallos | < 4.6.1 |
Related Weaknesses (CWE)
References
- https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960Patch
- https://github.com/ellite/Wallos/releases/tag/v4.6.1ProductRelease Notes
- https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjgExploitMitigationVendor Advisory
FAQ
What is CVE-2026-27479?
CVE-2026-27479 is a vulnerability with a CVSS score of 7.7 (HIGH). Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upl...
How severe is CVE-2026-27479?
CVE-2026-27479 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27479?
Check the references section above for vendor advisories and patch information. Affected products include: Wallosapp Wallos.