Wallos allows any authenticated user to store an arbitrary SMTP host in their email notification settings without server‑side validation. During a scheduled notification cron job, the stored host value is passed directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to the specified address. This flaw exposes the server to Server‑Side Request Forgery, enabling an attacker to probe internal network services from the server's perspective.

The affected product is Wallos from ellite. Users of any version before 5.0.0 are vulnerable. Version 5.0.0 and later include the fix.

The CVSS score of 3.5 indicates a low severity, and the EPSS score is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers need only legitimate credentials to set a malicious SMTP host; once set, the server can reach any internal or public IP address reachable from the host. This can result in internal reconnaissance but does not provide direct code execution or privilege escalation. The risk is therefore confined to a low‑privileged authenticated user and does not threaten remote attackers without valid credentials.