A Server‑Side Request Forgery flaw exists in the logo and icon upload functionality of Wallos. The application validates that a requested URL does not resolve to a private or reserved IP address, yet the subsequent cURL call follows HTTP redirects without re‑applying this validation. An attacker can supply a URL that redirects to an internal resource, allowing the server to make requests to internal services such as cloud instance metadata endpoints and potentially exfiltrate sensitive data or gain further foothold. The weakness is classified as CWE‑918. This flaw enables remote disclosure and manipulation of internal network resources, effectively elevating the potential impact from a simple denial of service to unauthorized internal data access.

Wallos versions 4.6.0 and earlier are affected. The vulnerability was patched in release 4.6.1, so any deployment still using 4.6.0 or a prior version retains the risk.

The CVSS score of 7.7 indicates a high severity. The EPSS score of <1% reflects a low exploitation probability, and the issue is not listed in the CISA KEV catalog. Nevertheless, the flaw can be leveraged via any authenticated or unauthenticated user who can upload logos, making it a realistic threat in environments where external image uploads are permitted. Attackers could use the redirect bypass to reach internal endpoints, including metadata services, thereby potentially compromising credentials or other sensitive information. The primary attack vector is remote via the logo upload interface; no special privileges are required beyond access to the upload functionality.