CVE-2026-30841: Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $GET["token"] and $GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> without calling htmlspecialchars(). This allows reflected XSS by breaking out of the attribute context. This issue has been patched in version 4.6.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30841?
CVE-2026-30841 has a medium severity rating due to the risk of reflected cross-site scripting (XSS).
How do I fix CVE-2026-30841?
To fix CVE-2026-30841, upgrade to Wallos version 4.6.2 or later, which mitigates the vulnerability effectively.
What components are affected by CVE-2026-30841?
CVE-2026-30841 affects the passwordreset.php file in Wallos versions prior to 4.6.2.
What type of vulnerability is CVE-2026-30841?
CVE-2026-30841 is a reflected cross-site scripting (XSS) vulnerability.
What happens if CVE-2026-30841 is exploited?
Exploitation of CVE-2026-30841 allows attackers to execute arbitrary scripts in the context of a user's browser session.