Wallos allows authenticated users to submit arbitrary SMTP host and port values to the test email notification endpoint. Because the application does not validate these inputs, PHPMailer is instructed to connect to the attacker‑supplied host:port, enabling a Server Side Request Forgery. This flaw can expose internal network resources, such as internal services or cloud metadata endpoints, leading to information disclosure or potential further compromise. The weakness is a classic SSRF scenario, identified as CWE‑918, with the potential to reach any host reachable from the server.

The vendor is ellite and the product is the Wallos open‑source personal subscription tracker. All releases before 4.9.6 contain the vulnerability. Values from 4.9.0 to 4.9.5 and earlier are affected. The issue was fixed in release 4.9.6.

The vulnerability has a CVSS score of 8.2, indicating high severity. EPSS is not available, but the lack of a published KEV listing suggests the exploit is not currently in widespread, documented use. The attack requires authentication to the application; any authenticated user can request the test email endpoint and supply attacker‑controlled SMTP details. The lack of input sanitization means the attacker can target internal IP ranges, cloud metadata services, or other network resources, potentially gathering sensitive information or facilitating further compromise.