Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.
Published: 2026-08-31
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A crafted ZIP file can be uploaded to the database restore endpoint, where the application extracts its contents without validating path traversal sequences. This flaw is a path traversal weakness (CWE-22). By including files such as logos/../../endpoints/shell.php, an attacker can cause a webshell to be written to the web root, allowing arbitrary code execution on the host server.

Affected Systems

All releases of the Wallos personal subscription tracker prior to version 4.9.6 are affected, including the 4.9.5 and earlier builds. The security issue is fixed in v4.9.6 and later.

Risk and Exploitability

The vulnerability scores a CVSS score of 8.5, indicating a high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the POST /endpoints/db/restore.php endpoint, requiring administrative credentials but potentially reachable over the network. Successful exploitation results in top‑level code execution on the web server.

Generated by OpenCVE AI on August 31, 2026 at 22:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Wallos version 4.9.6 or later to remove the ZipArchive extraction flaw.
  • Restrict the /endpoints/db/restore.php service to authenticated administrators and enforce HTTPS to limit external exposure.
  • If immediate upgrade is not feasible, deny write permissions to the web root directory or implement input validation that rejects file names containing path traversal characters before extraction.

Generated by OpenCVE AI on August 31, 2026 at 22:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Ellite
Ellite wallos
Vendors & Products Ellite
Ellite wallos

Mon, 31 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.
Title Wallos: Zip Slip path traversal in database restore writes files to webroot
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ellite Wallos
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-31T20:44:05.909Z

Reserved: 2026-07-10T17:38:57.111Z

Link: CVE-2026-61639

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T21:17:17.103

Modified: 2026-08-31T21:17:17.103

Link: CVE-2026-61639

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T22:30:06Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')