CVE-2026-77351: Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Wallos user with access to their personal email notification settings can set a malicious SMTP host. Exploitation does not require user interaction, but it depends on the scheduled notification cron job running.
Which deployments are affected?
Wallos versions prior to 5.0.0 are affected. The issue is relevant where the Wallos server can make outbound TCP connections to internal services or cloud-metadata addresses.
What can an attacker do through the SMTP host setting?
An attacker can cause the Wallos server to initiate outbound TCP connections to attacker-specified addresses, including private-network and cloud-metadata IP addresses. This can be used to probe services reachable from the server's network position.
How can I determine whether my instance may have been abused?
Review authenticated users' personal email notification settings for SMTP hosts pointing to private, loopback, link-local, or cloud-metadata addresses. Also review outbound connection logs around scheduled notification cron job executions for unexpected destinations.
What should I do if I cannot immediately upgrade?
Restrict who can authenticate to Wallos and limit the server's outbound network access, particularly to private networks and cloud-metadata endpoints. Upgrading to version 5.0.0 is the documented fix.