# CVE-2026-61639: Wallos path traversal in database restore

Source: https://junglewise.ai/threats/cve-2026-61639-wallos-path-traversal-in-database-restore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61639 · Severity: info · CVSS 8.8 · Published 2026-08-31

Wallos is an open-source subscription tracking application that allows administrators to restore a database from a backup. Prior to version 4.9.6, the restore function did not properly validate file paths in uploaded ZIP archives, allowing an authenticated admin to upload a malicious archive that extracts files outside the intended directory and plants a web shell in the application's web root for remote code execution.

## Quick answers

**Is CVE-2026-61639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61639 being exploited in the wild.

**How severe is CVE-2026-61639?** Informational severity, with a CVSS score of 8.8, published 31 August 2026.

**Which products and versions are affected?** Wallos Wallos before 4.9.6.

**Is there a fix for CVE-2026-61639?** A patch was published on 2026-06-22: Version 4.9.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61639 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61639?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a ZIP path traversal (ZIP slip) vulnerability in the POST /endpoints/db/restore.php endpoint. The vulnerable code calls ZipArchive::extractTo() without validating entry names for directory traversal sequences (../ patterns). An authenticated admin attacker can craft a malicious ZIP file with entries like "logos/../../endpoints/shell.php" that, when extracted, bypass the intended directory structure and write arbitrary files to the web root. The extension filter intended to prevent this only applies to the post-extraction logo copy step, not the initial extraction itself. The vulnerability has been patched in version 4.9.6 with proper path validation.

## Affected products

- Wallos Wallos before 4.9.6

## Timeline

- 2026-08-31: disclosed
- 2026-06-22: patched: Version 4.9.6 released

## References

- [https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3](https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3)
- [https://github.com/ellite/Wallos/pull/1092](https://github.com/ellite/Wallos/pull/1092)