Quick answers
- Is CVE-2026-61638 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-61638 being exploited in the wild.
- How severe is CVE-2026-61638?
- Informational severity, published 31 August 2026.
- Which products and versions are affected?
- Wallos Wallos before 4.9.6.
- Is there a fix for CVE-2026-61638?
- A patch was published on 2026-06-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-61638 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-61638?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the POST /endpoints/notifications/testemailnotifications.php endpoint. The endpoint accepts smtpaddress and smtpport parameters from the request body without validation and passes them directly to PHPMailer, which establishes a connection to the attacker-supplied host and port. While all other notification endpoints in the application use ssrf_helper.php for validation, the email notification endpoint was missed during implementation. The attack requires authentication to access the endpoint. An attacker can use this to probe internal network ranges, access cloud metadata services (e.g., AWS metadata endpoints), or perform reconnaissance on internal infrastructure. The issue has been patched in version 4.9.6.
Affected products
- Wallos Wallos before 4.9.6
Timeline
- 2026-08-31: disclosed
- 2026-06-22: patched