Skip to content
OpenAdvisories
High · 8.7 CVE-2026-30828 EUVD-2026-10116

Wallos: SSRF via url parameter leading to File Traversal

Published Mar 7, 2026 · Updated Mar 9, 2026 · Assigned by GitHub_M

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2.

Affected products

VendorProductAffectedFixed
ellite Wallos < 4.6.2 —

References