Wallos, an open‑source subscription tracker, is vulnerable to server side request forgery in versions 4.8.4 and earlier. The incomplete SSRF fix validates webhook URLs with gethostbyname but fails to pin the resolved hostname on cURL for most outbound HTTP calls, creating a DNS rebinding TOCTOU window. This flaw can allow an attacker to craft requests that cause the vulnerable instance to resolve an attacker‑controlled hostname and then use the original resolved IP to reach internal services. The consequence is that an attacker could access or manipulate internal resources, potentially leading to data exfiltration, privilege escalation, or further exploitation of internal hosts.

The affected product is Wallos from ellite, running any release with version 4.8.4 or older. No further version details are provided. The vulnerability applies when the application calls outbound HTTP endpoints, such as webhook URLs, that are configured by users.

The CVSS base score of 7.7 classifies this as high severity. No EPSS score is available, so the exploitation likelihood cannot be quantified, but the presence of a TOCTOU window and lack of a public patch suggest that the risk is non‑negligible, especially for exposed installations. The vulnerability is not listed in the CISA KEV catalog. An attacker can launch the exploit by injecting a malicious webhook URL that resolves to an attacker‑controlled hostname, then triggering the remote call to the original IP address. The attack requires network access to the vulnerable instance and the ability to manipulate its webhook configuration.