CVE-2026-41687: Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the SSRF protection in endpoints/subscription/add.php (line 42) and endpoints/payments/add.php (line 40) uses an inline IP validation check (FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE) that does not block CGNAT addresses (100.64.0.0/10, RFC 6598). The includes/ssrfhelper.php file explicitly defines iscgnatip() to cover this gap (used by notification endpoints), but the logo/icon URL fetching in subscription and payment endpoints performs its own inline validation that misses this range. This allows authenticated users to perform Blind SSRF to internal services in Tailscale, Carrier-Grade NAT, and other environments using 100.64.0.0/10 addresses. This issue has been patched in version 4.8.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41687?
CVE-2026-41687 has not been assigned a specific severity rating, but it is important to address the SSRF vulnerability in the affected versions.
How do I fix CVE-2026-41687?
To fix CVE-2026-41687, update Wallos to version 4.8.1 or later, where the vulnerability has been addressed.
What does CVE-2026-41687 affect?
CVE-2026-41687 affects Wallos versions prior to 4.8.1, specifically in the subscription and payments modules.
What kind of vulnerability is CVE-2026-41687?
CVE-2026-41687 is a Server-Side Request Forgery (SSRF) vulnerability that could allow attackers to bypass CGNAT protections.
Who is affected by CVE-2026-41687?
Any users of Wallos on versions before 4.8.1 are potentially vulnerable to CVE-2026-41687.