VULNERABILITY INTELLIGENCE
CVE-2026-61639
EPSS probability0.51%
CISA KEVNot currently listed
Published2026-08-31
Last modified2026-09-08
Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.
Weakness classification
- security-advisories@github.com: CWE-22