The vulnerability in Wallos arises from the handling of the url parameter, which permits a client to specify a path that can traverse the local filesystem. This flaw enables logical path traversal and Server Side Request Forgery, allowing an attacker to obtain arbitrary files on the host, potentially including sensitive configuration or credentials. The primary impact is the disclosure of local files, compromising confidentiality.

All releases of the open‑source Wallos personal subscription tracker from ellite prior to version 4.6.2 are affected; the problem was fixed in the 4.6.2 release.

The CVSS score of 8.7 conveys a high severity assessment, yet the EPSS value of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is a crafted HTTP request to the vulnerable endpoint that supplies a malicious url parameter referencing relative or absolute paths. Because this flaw is remotely exploitable and can disclose local files, it should be treated as a high‑risk information disclosure vector.