Vulnerabilities ›

CVE-2026-27479

High ⚡ Exploit Available

CWE-918 — Weakness Type

                    Published: Feb 21, 2026                      ·  Modified: Feb 28, 2026                      ·  Source: NVD                

CVSS v3

7.7

🔗 NVD Official

📄 Description (English)

Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1.

🤖 AI Executive Summary

Wallos subscription tracker versions 4.6.0 and below contain a critical Server-Side Request Forgery (SSRF) vulnerability in logo upload functionality. Attackers can bypass IP validation through HTTP redirects to access internal resources and cloud metadata endpoints. The vulnerability is actively exploitable and affects self-hosted instances commonly used by organizations for subscription management.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Apr 29, 2026 15:35

🇸🇦 Saudi Arabia Impact Assessment

Saudi organizations using self-hosted Wallos instances for subscription management face significant risk, particularly in: Banking sector (subscription tracking for services), Government agencies (expense management systems), Healthcare institutions (medical subscription tracking), Telecommunications companies (service subscription management), and Enterprise IT departments. The SSRF vulnerability could allow attackers to access internal cloud infrastructure, extract credentials from metadata endpoints (AWS/Azure), pivot to internal systems, and compromise sensitive subscription and payment data. Organizations in Saudi Arabia relying on cloud infrastructure (AWS, Azure, Google Cloud) are at heightened risk of metadata endpoint exploitation.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Healthcare and Medical Services Energy and Utilities Telecommunications Enterprise IT and Cloud Services E-commerce and Retail

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1498 - Network Denial of Service T1557 - Man-in-the-Middle T1040 - Traffic Redirection T1526 - Gather Victim Cloud Infrastructure Information T1592 - Gather Victim Host Information T1199 - Trusted Relationship T1021 - Remote Services

⚖️ Saudi Risk Score (AI)

8.2

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Identify all Wallos instances running versions 4.6.0 or below in your environment

2. Restrict network access to Wallos instances to trusted users only

3. Implement network segmentation to prevent Wallos from accessing internal resources

4. Review logs for suspicious logo/icon upload requests with redirect patterns



PATCHING:

1. Upgrade Wallos to version 4.6.1 or later immediately

2. Verify patch deployment across all instances

3. Restart Wallos services after patching



COMPENSATING CONTROLS (if immediate patching not possible):

1. Disable logo/icon upload functionality temporarily via application configuration

2. Implement WAF rules to block requests to logo upload endpoints

3. Configure firewall rules to prevent Wallos from reaching internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16)

4. Block access to cloud metadata endpoints (169.254.169.254, metadata.google.internal)

5. Implement egress filtering on network level



DETECTION:

1. Monitor for HTTP 3xx redirect responses in Wallos application logs

2. Alert on logo upload requests followed by internal IP access attempts

3. Track outbound connections to 169.254.169.254 or cloud metadata endpoints

4. Review application logs for multiple redirect chains (CURLOPT_MAXREDIRS = 3)

5. Implement IDS/IPS signatures for SSRF redirect patterns

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. حدد جميع حالات Wallos التي تعمل بالإصدارات 4.6.0 أو أقل في بيئتك

2. قيد الوصول إلى شبكة Wallos للمستخدمين الموثوقين فقط

3. طبق تقسيم الشبكة لمنع Wallos من الوصول إلى الموارد الداخلية

4. راجع السجلات للطلبات المريبة لتحميل الشعارات/الرموز مع أنماط إعادة التوجيه

التصحيح:

1. قم بترقية Wallos إلى الإصدار 4.6.1 أو أحدث على الفور

2. تحقق من نشر التصحيح عبر جميع الحالات

3. أعد تشغيل خدمات Wallos بعد التصحيح

الضوابط البديلة (إذا لم يكن التصحيح الفوري ممكناً):

1. عطل وظيفة تحميل الشعار/الرمز مؤقتاً عبر تكوين التطبيق

2. طبق قواعد WAF لحظر الطلبات إلى نقاط نهاية تحميل الشعار

3. قم بتكوين قواعد جدار الحماية لمنع Wallos من الوصول إلى نطاقات IP الداخلية

4. احظر الوصول إلى نقاط نهاية بيانات السحابة

5. طبق تصفية الخروج على مستوى الشبكة

الكشف:

1. راقب استجابات HTTP 3xx في سجلات تطبيق Wallos

2. أصدر تنبيهات لطلبات تحميل الشعار متبوعة بمحاولات الوصول إلى IP الداخلية

3. تتبع الاتصالات الصادرة إلى نقاط نهاية بيانات السحابة

4. راجع سجلات التطبيق للسلاسل المتعددة للإعادة

5. طبق توقيعات IDS/IPS لأنماط SSRF

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.1 - Information Security Policies and Procedures 5.2 - Access Control and Authentication 5.3 - Cryptography and Data Protection 5.4 - Secure Development and Deployment 5.5 - Vulnerability Management 5.6 - Incident Management

🔵 SAMA CSF

Governance - Risk Management Framework Protect - Access Control Protect - Data Protection Detect - Monitoring and Detection Respond - Incident Response

🟡 ISO 27001:2022

A.5.1 - Policies for information security A.6.1 - Internal organization A.8.1 - Asset management A.12.6 - Change management A.14.2 - Secure development policy A.14.3 - Secure application development

🟣 PCI DSS v4.0.1

Requirement 1 - Firewall configuration Requirement 2 - Default security parameters Requirement 6 - Secure development and vulnerability management Requirement 11 - Security testing and monitoring

🔗 References & Sources 3

🔗

https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960

security-advisories@github.com

Patch

🔗

https://github.com/ellite/Wallos/releases/tag/v4.6.1

security-advisories@github.com

Product Release Notes

🔗

https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg

security-advisories@github.com

Exploit Mitigation Vendor Advisory

📦 Affected Products / CPE 1 entries

wallosapp:wallos

📊 CVSS Score

7.7

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeC — Changed

ConfidentialityH — High

IntegrityN — None / Network

AvailabilityN — None / Network

📋 Quick Facts

Severity High

CVSS Score7.7

CWECWE-918

EPSS0.03%

Exploit ✓ Yes

Patch ✓ Yes

Published 2026-02-21

Source Feed nvd

🇸🇦 Saudi Risk Score

8.2

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

exploit-available patch-available CWE-918

🏢 Vendor Advisories

🔗 https://github.com/ellite/Wallos/security/advisories...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-27479

💬 Comments

Introduce Yourself

Sign In Required