Executive brief
Wallos is a self-hosted subscription tracking application that allows users to export their subscription data as calendar feeds. Prior to version 5.0.0, authenticated users could inject malicious content into shared calendar feeds by embedding newline characters in subscription names or notes. An attacker with a valid account could craft subscriptions that break out of the calendar event structure and insert fake calendar events with spoofed organizers and misleading content, affecting anyone subscribed to that feed.
Technical details
This is a CRLF injection vulnerability in the iCalendar (.ics) export functionality. The root cause is inconsistent encoding: the input validation layer encodes only HTML metacharacters but does not strip or encode newline sequences (CRLF), while the export layer then decodes HTML entities before writing the iCalendar output, allowing embedded CRLF sequences to break out of the VEVENT block. An authenticated attacker can craft a subscription whose name or notes contain raw CRLF sequences, which will then be decoded during export and injected into the .ics feed, allowing insertion of fully attacker-controlled calendar events including arbitrary ATTENDEE properties and organizer information. The vulnerability requires authentication but affects the integrity of exported feeds consumed by calendar applications. The fix was deployed in version 5.0.0 with proper escaping of iCalendar property values.
Affected products
- ellite Wallos prior to 5.0.0
Timeline
- 2026-08-31: disclosed: CVE-2026-77353 published
- 2026-07-11: patched: Fix deployed in version 5.0.0 with iCalendar property value escaping