Wallos, an open-source subscription tracker, had a flaw that allowed any authenticated user to inject arbitrary iCalendar properties into exported .ics files by embedding raw CRLF sequences in subscription names or notes. The application only encoded HTML metacharacters but did not strip newline characters, and during export the data was decoded back before being written to the iCal output. This enabled a malicious user to break out of the current VEVENT block and add fully attacker‑controlled events, including spoofed organizers, arbitrary email addresses in ATTENDEE fields, and misleading event descriptions. Once injected, the forged events appear in any calendar application that subscribes to the victim’s feed, effectively allowing the attacker to corrupt, spoof, or otherwise manipulate calendar data for that user.

The vulnerability affects the open‑source Wallos platform produced by ellite. All versions before 5.0.0 are impacted; users running v4.x or earlier are vulnerable. The affected component is the subscription export functionality that accepts raw input from users with valid Wallos accounts.

The CVSS score of 4.6 indicates a moderate severity risk. Exploitation requires a legitimate authenticated account and the ability to export an .ics feed, which is normally available to all users. EPSS data is not available, and the vulnerability is currently not listed in the CISA KEV catalog. Therefore, while the potential impact on calendar integrity is significant, the attack vector is limited to insiders or users who have gained a user account. A moderate effort is required to craft the injection payload, but the overall risk remains manageable pending a patch.