Executive brief
Wallos is a self-hosted subscription tracker that allows users to manage their recurring payments in one place. Prior to version 4.9.6, an authenticated user could bypass email server validation to probe internal networks and access cloud metadata, potentially discovering sensitive infrastructure details or credentials used by the application or its host environment.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the POST /endpoints/notifications/testemailnotifications.php endpoint. The endpoint accepts smtpaddress and smtpport parameters from the request body without validation and passes them directly to PHPMailer, which establishes a connection to the attacker-supplied host and port. While all other notification endpoints in the application use ssrf_helper.php for validation, the email notification endpoint was missed during implementation. The attack requires authentication to access the endpoint. An attacker can use this to probe internal network ranges, access cloud metadata services (e.g., AWS metadata endpoints), or perform reconnaissance on internal infrastructure. The issue has been patched in version 4.9.6.
Affected products
- Wallos Wallos before 4.9.6
Timeline
- 2026-08-31: disclosed
- 2026-06-22: patched