CVE-2026-61639: Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.9.6 - Compensating control
Restrict external/public access so that POST /endpoints/db/restore.php cannot be invoked by untrusted users (e.g., enforce authentication and limit access via network controls/ACL).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrator access to upload a crafted ZIP archive through the database restore endpoint. The described impact is writing a webshell into the webroot.
Which deployments are affected?
Wallos versions before 4.9.6 are affected. The vulnerable functionality is the database restore endpoint at POST /endpoints/db/restore.php.
Is filtering ZIP contents by file extension sufficient mitigation?
No. The extension filter described applies only to a post-extraction logo copy step, while ZipArchive::extractTo() extracts crafted traversal entries before that filter is applied.
How can I check for potential compromise?
Review use of the database restore endpoint and inspect the webroot, including the endpoints directory, for unexpected files such as shell.php or other unrecognized PHP files. A crafted archive can use a path such as logos/../../endpoints/shell.php to place files outside the intended extraction location.
What is the available remediation?
Upgrade Wallos to version 4.9.6, which patches the issue.