CVE-2026-27479

Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1.

• CWE-918

• https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960Patch
• https://github.com/ellite/Wallos/releases/tag/v4.6.1Product, Release Notes
• https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjgExploit, Mitigation, Vendor Advisory

Published

Feb 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27473SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) v…6.4
• CVE-2026-27474SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the p…6.1
• CVE-2026-27475SPIP before 4.4.9 allows Insecure Deserialization in the pub…9.2
• CVE-2026-27476RustFly 2.0.0 contains a command injection vulnerability in …9.8
• CVE-2026-27477Mastodon is a free, open-source social network server based …5.9
• CVE-2026-27478Unity Catalog is an open, multi-modal Catalog for data and A…9.1
• CVE-2026-2748SEPPmail Secure Email Gateway before version 15.0.1 improper…5.3
• CVE-2026-27480Static Web Server (SWS) is a production-ready web server sui…5.3
• CVE-2026-27481Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-27482Ray is an AI compute engine. In versions 2.53.0 and below, t…6.5
• CVE-2026-27483MindsDB is a platform for building artificial intelligence f…8.8
• CVE-2026-27484OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.3