CVE-2026-30839mediumCWE-918

CVE-2026-30839: falha de média gravidade em ellite Wallos

Wallos: SSRF via webhook test endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Wallos

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in version 4.6.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ellite · Wallos
CVEs relacionadas — ellite Wallos

No mesmo produto, das mais perigosas para as menos.

CVE-2026-30828HIGHWallos: SSRF via url parameter leading to File TraversalEPSS 0.6%CVE-2026-54600HIGHWallos: Unauthenticated database replacement via import endpoint on fresh installEPSS 0.6%CVE-2026-61640HIGHWallos: SSRF via OIDC Token/UserInfo URL ConfigurationEPSS 0.5%CVE-2026-61641HIGHWallos: OIDC account takeover via email-based account linking without `email_verified` checkEPSS 0.5%CVE-2026-30840HIGHWallos: Server-Side Request Forgery (SSRF) in Notification TestersEPSS 0.5%CVE-2026-61639HIGHWallos: Zip Slip path traversal in database restore writes files to webrootEPSS 0.5%