Quick answers
- Is CVE-2026-54598 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54598 being exploited in the wild.
- How severe is CVE-2026-54598?
- High severity, with a CVSS score of 7.5, published 31 August 2026.
- Which products and versions are affected?
- Ellite Wallos prior to 4.9.4.
- Is there a fix for CVE-2026-54598?
- A patch was published on 2026-06-06. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54598 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-54598?
- Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing authentication check (CWE-306) in endpoints/db/migrate.php. The endpoint loads include files but never validates user authentication (no check of $_SESSION, $userId, or auth guards); instead, it immediately executes pending database migrations. An unauthenticated attacker can send an HTTP request to trigger arbitrary pending migration files via require_once, which executes DDL commands against the live SQLite database. If chained with a file write primitive, this can lead to remote code execution. The vulnerability affects versions prior to 4.9.4, which adds admin authentication validation. Attack vector is network-based with no authentication, complexity, or user interaction required.
Affected products
- ellite Wallos prior to 4.9.4
Timeline
- 2026-06-09: disclosed
- 2026-06-06: patched