Executive brief
Wallos is an open-source personal subscription tracker that self-hosts on user servers. Any logged-in user can exploit a security gap to force the server to make outbound connections to internal or private IP addresses by manipulating email notification settings. This could enable attacks on internal services, database servers, or other sensitive infrastructure on the same network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the per-user email notification settings endpoint (endpoints/notifications/saveemailnotifications.php) in Wallos versions 2.0.0 through 4.x. The endpoint accepts user-controlled SMTP host values without validation. When a subscription notification is triggered, the cron job (endpoints/cronjobs/sendnotifications.php) passes this host directly to PHPMailer's $mail->Host property, causing the server to initiate SMTP connections to arbitrary internal or link-local addresses. No administrator privileges are required—any authenticated user can exploit this. The vulnerability was patched in version 5.0.0 by adding SSRF validation to the SMTP host parameter.
Affected products
- Wallos Wallos 2.0.0 to before 5.0.0
Timeline
- 2026-08-31: disclosed
- 2026-07-11: patched: Version 5.0.0 released with SSRF validation fix