CVE-2026-61640

Wallos before version 5.0.0 allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. An attacker can break out of the current VEVENT block and insert attacker-controlled calendar events, including spoofed organizers and email addresses, into any calendar application subscribed to that feed.

Wallos from version 2.0.0 to before 5.0.0 allows any authenticated user (no admin rights required) to make the server open arbitrary outbound SMTP connections to internal/link-local addresses by setting the SMTP host of their personal email notifications to an internal IP. Lack of SSRF validation in the notification settings endpoint and the notification cron leads to connections to the chosen host:port.

Wallos prior to version 5.0.0 allows any authenticated user to store an arbitrary SMTP host (including private and cloud-metadata IP addresses) in their email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to the specified address. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

Wallos before version 5.0.0 ships a second, near-identical, unauthenticated logo-image search endpoint (endpoints/payments/search.php) that was not hardened against SSRF. It passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY.

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.

Wallos before version 4.9.6 contains a path traversal vulnerability in the POST /endpoints/db/restore.php endpoint. The ZipArchive::extractTo() function does not validate entry names for '../' sequences, allowing an admin to upload a crafted zip with logos/../../endpoints/shell.php to write a webshell to the webroot. The extension filter only applies to the post-extraction logo copy step, so it does not prevent this attack.

Wallos before version 4.9.6 contains an SSRF vulnerability in the POST /endpoints/notifications/testemailnotifications.php endpoint. The smtpaddress and smtpport parameters are taken from the POST body with zero SSRF validation, and PHPMailer connects to the attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network and access cloud metadata.

Wallos before version 4.9.4 has an authentication bypass vulnerability in the endpoints/db/import.php endpoint. The only guard is a user-table row count – if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database.

Wallos before version 4.9.4 has a vulnerability in the OIDC mechanism. login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account.

Wallos before version 4.9.4 has an authentication bypass vulnerability in the endpoints/db/migrate.php endpoint. This endpoint executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database.