Authenticated Wallos users can configure the SMTP host in their personal notification settings to an arbitrary internal or link‑local IP address. When the subscription notification cron executes, the server feeds this user‑supplied host directly to PHPMailer, which results in the server opening an outbound SMTP connection to the specified address. This flaw permits the application to initiate SMTP connections to arbitrary internal hosts. Based on the description, it could potentially access internal services, but the advisory does not confirm any further exploitation or impact.

Wallos, the open‑source personal subscription tracker from ellite, is affected in all releases from 2.0.0 through just before version 5.0.0. The issue was patched in version 5.0.0, which eliminates the unvalidated SMTP host handling.

The CVSS score of 4.3 moderate risk. No EPSS score is published, and the vulnerability is not listed in CISA KEV. The attack vector is internal‑network communication; an attacker must first gain a legitimate authenticated session on the Wallos instance. Because the compromised server can reach any internal target, the potential impact depends on the internal architecture: sensitive internal services may be accessed, but exploitation does not automatically lead to full system compromise. The lack of a known public exploit and the requirement for authentication lower the real‑world exploitation probability, though an attacker controlling an account could still pivot within the network.