Executive brief
Wallos is an open-source subscription tracking application that allows administrators to restore a database from a backup. Prior to version 4.9.6, the restore function did not properly validate file paths in uploaded ZIP archives, allowing an authenticated admin to upload a malicious archive that extracts files outside the intended directory and plants a web shell in the application's web root for remote code execution.
Technical details
This is a ZIP path traversal (ZIP slip) vulnerability in the POST /endpoints/db/restore.php endpoint. The vulnerable code calls ZipArchive::extractTo() without validating entry names for directory traversal sequences (../ patterns). An authenticated admin attacker can craft a malicious ZIP file with entries like "logos/../../endpoints/shell.php" that, when extracted, bypass the intended directory structure and write arbitrary files to the web root. The extension filter intended to prevent this only applies to the post-extraction logo copy step, not the initial extraction itself. The vulnerability has been patched in version 4.9.6 with proper path validation.
Affected products
- Wallos Wallos before 4.9.6
Timeline
- 2026-08-31: disclosed
- 2026-06-22: patched: Version 4.9.6 released