CVE-2026-61638: Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrfhelper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.9.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Wallos user can submit attacker-controlled SMTP host and port values to the test email notification endpoint. The issue can be used to probe internal network services and cloud metadata endpoints reachable from the Wallos server.
Are default installations affected?
The vulnerable endpoint accepts the SMTP address and port from the POST body without SSRF validation, so exposure depends on an authenticated user being able to access the test email notification function. No additional configuration prerequisite is stated.
What version fixes the issue?
Upgrade Wallos to version 4.9.6 or later. The vulnerability affects versions prior to 4.9.6.
What can be done before upgrading?
Restrict access to Wallos to trusted authenticated users and limit the Wallos host's outbound network access, particularly to internal services and cloud metadata endpoints. This reduces the targets that can be reached through the vulnerable SMTP connection.