CVE-2026-27479

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27479", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-19T19:46:03.540Z", "datePublished": "2026-02-21T08:15:19.953Z", "dateUpdated": "2026-02-24T18:24:31.376Z"}, "containers": {"cna": {"title": "Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg"}, {"name": "https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960"}, {"name": "https://github.com/ellite/Wallos/releases/tag/v4.6.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellite/Wallos/releases/tag/v4.6.1"}], "affected": [{"vendor": "ellite", "product": "Wallos", "versions": [{"version": "< 4.6.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T08:15:19.953Z"}, "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1."}], "source": {"advisory": "GHSA-fgmf-7g5v-jmjg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:24:13.699741Z", "id": "CVE-2026-27479", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:24:31.376Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27479", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:24:13.699741Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:24:22.961Z"}}], "cna": {"title": "Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch", "source": {"advisory": "GHSA-fgmf-7g5v-jmjg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ellite", "product": "Wallos", "versions": [{"status": "affected", "version": "< 4.6.1"}]}], "references": [{"url": "https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg", "name": "https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960", "name": "https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ellite/Wallos/releases/tag/v4.6.1", "name": "https://github.com/ellite/Wallos/releases/tag/v4.6.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T08:15:19.953Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27479", "state": "PUBLISHED", "dateUpdated": "2026-02-24T18:24:31.376Z", "dateReserved": "2026-02-19T19:46:03.540Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-21T08:15:19.953Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Wallos", "vendor": "ellite", "versions": [{"status": "affected", "version": "< 4.6.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FE90B6B-D0F1-4B0C-8629-56F91ECBF6AF", "versionEndExcluding": "4.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1."}, {"lang": "es", "value": "Wallos es un rastreador de suscripciones personal de c\u00f3digo abierto y autoalojable. Versiones 4.6.0 e inferiores contienen una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en la funcionalidad de carga de logotipos/iconos de suscripci\u00f3n y pago. La aplicaci\u00f3n valida la direcci\u00f3n IP de la URL proporcionada antes de realizar la petici\u00f3n, pero permite redirecciones HTTP (CURLOPT_FOLLOWLOCATION = true), lo que permite a un atacante eludir la validaci\u00f3n de IP y acceder a recursos internos, incluyendo puntos finales de metadatos de instancias en la nube. La funci\u00f3n getLogoFromUrl() valida la URL resolviendo el nombre de host y comprobando si la direcci\u00f3n IP resultante est\u00e1 en un rango privado o reservado usando FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. Sin embargo, la petici\u00f3n cURL subsiguiente est\u00e1 configurada con CURLOPT_FOLLOWLOCATION = true y CURLOPT_MAXREDIRS = 3, lo que significa que la petici\u00f3n seguir\u00e1 las redirecciones HTTP sin revalidar la direcci\u00f3n IP de destino. Este problema ha sido solucionado en la versi\u00f3n 4.6.1."}], "id": "CVE-2026-27479", "lastModified": "2026-06-17T10:27:13.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27479", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:24:13.699741Z", "version": "2.0.3"}}]}, "published": "2026-02-21T09:15:53.923", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/ellite/Wallos/releases/tag/v4.6.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.6.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Wallos", "source": "cna", "vendor": "ellite"}, "product": "wallos", "vendor": "ellite"}], "analysis": {"en": {"generated_at": "2026-04-17T16:48:51.682107+00:00", "value": {"mitigation_remediation": ["Upgrade Wallos to version 4.6.1 or later to eliminate the redirect bypass in logo/icon URL fetching.", "If an immediate upgrade is not possible, disable the logo and icon upload feature or block outbound HTTP requests from the Wallos application to prevent internal resource access.", "Configure the web server or network firewall to restrict Wallos\u2019 outbound traffic to only approved trusted hosts, blocking access to cloud metadata services and other internal endpoints."], "summary": {"action": "Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Wallos versions 4.6.0 and earlier are affected. The vulnerability was patched in release 4.6.1, so any deployment still using 4.6.0 or a prior version retains the risk.", "description_and_impact": "A Server\u2011Side Request Forgery flaw exists in the logo and icon upload functionality of Wallos. The application validates that a requested URL does not resolve to a private or reserved IP address, yet the subsequent cURL call follows HTTP redirects without re\u2011applying this validation. An attacker can supply a URL that redirects to an internal resource, allowing the server to make requests to internal services such as cloud instance metadata endpoints and potentially exfiltrate sensitive data or gain further foothold. The weakness is classified as CWE\u2011918. This flaw enables remote disclosure and manipulation of internal network resources, effectively elevating the potential impact from a simple denial of service to unauthorized internal data access.", "risk_and_exploitability": "The CVSS score of 7.7 indicates a high severity. The EPSS score of <1% reflects a low exploitation probability, and the issue is not listed in the CISA KEV catalog. Nevertheless, the flaw can be leveraged via any authenticated or unauthenticated user who can upload logos, making it a realistic threat in environments where external image uploads are permitted. Attackers could use the redirect bypass to reach internal endpoints, including metadata services, thereby potentially compromising credentials or other sensitive information. The primary attack vector is remote via the logo upload interface; no special privileges are required beyond access to the upload functionality."}}}}, "created": "2026-02-23T14:32:15.634916+00:00", "updated": "2026-04-17T17:00:10.160066+00:00", "vendors": ["ellite", "ellite$PRODUCT$wallos"]}