CVE-2026-61638

UNKNOWN 0.0

Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.

CWE	CWE-918
Vendor	ellite
Product	wallos
Published	Aug 31, 2026

Stay Ahead of the Next One

Get instant alerts for ellite wallos

Be the first to know when new unknown vulnerabilities affecting ellite wallos are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

ellite / Wallos

< 4.9.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ellite/Wallos/security/advisories/GHSA-f8r5-v75m-385h github.com: https://github.com/ellite/Wallos/pull/1092 github.com: https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3 github.com: https://github.com/ellite/Wallos/releases/tag/v4.9.6