Wallos, an open‑source subscription tracker, contains an endpoint that sends arbitrary URLs to remote servers without validating them against private or reserved IP ranges. Attackers can target internal network services and obtain the response, effectively reading sensitive data or exposing internal infrastructure. The vulnerability was fixed in version 4.6.2 by adding proper URL validation and response handling.

All installations of Wallos produced by ellite that run a version older than 4.6.2 are affected. The product is a self‑hosted personal subscription tracker.

The CVSS base score of 5.3 classifies the issue as moderate severity. The EPSS score of less than 1% indicates low likelihood of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires access to the exposed webhook testing endpoint; an attacker can craft a malicious request to read internal resources. The impact is limited to the scope of the server hosting Wallos, but it could expose sensitive internal endpoints if the system is network‑connected to private infrastructure.