Description
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.
References (2)
Core 2
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/ellite/Wallos/security/advisories/GHSA-h4g7-xv3v-q73g
X_Refsource_Misc x_refsource_misc
https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef
Scores
CVSS v3
7.7
EPSS
0.0003
EPSS Percentile
9.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-918
Status
published
Products (1)
ellite/Wallos
<= 4.8.4
Published
May 07, 2026
Tracked Since
May 07, 2026