Executive brief
Wallos is an open-source subscription tracker that allows users to manage recurring payments and send email notifications. Prior to version 5.0.0, any authenticated user could configure an arbitrary SMTP server address—including internal network IPs or cloud metadata endpoints—in their email settings. When Wallos sends notifications, it connects to the attacker-specified address, enabling them to probe internal services and potentially access sensitive cloud metadata, without requiring any special privileges.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in the email notification feature. The vulnerable component is the SMTP configuration in user email notification settings, which accepted and stored arbitrary hostnames without server-side validation. When the scheduled notification cron job executes, it passes the stored SMTP host directly to PHPMailer, causing the Wallos server to open outbound TCP connections to attacker-controlled addresses. An authenticated user (any user with an account) can exploit this with no additional preconditions to probe internal network services, including private IP ranges and cloud metadata endpoints, from the server's network perspective. The vulnerability has been patched in version 5.0.0 with SMTP host validation against SSRF.
Affected products
- Wallos Wallos before 5.0.0
Timeline
- 2026-07-11: patched: Fixed in version 5.0.0 with SMTP host validation
- 2026-08-31: disclosed