{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Wallos",
          "vendor": "ellite",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FE90B6B-D0F1-4B0C-8629-56F91ECBF6AF",
              "versionEndExcluding": "4.6.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1."
    },
    {
      "lang": "es",
      "value": "Wallos es un rastreador de suscripciones personal de c\u00f3digo abierto y autoalojable. Versiones 4.6.0 e inferiores contienen una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en la funcionalidad de carga de logotipos/iconos de suscripci\u00f3n y pago. La aplicaci\u00f3n valida la direcci\u00f3n IP de la URL proporcionada antes de realizar la petici\u00f3n, pero permite redirecciones HTTP (CURLOPT_FOLLOWLOCATION = true), lo que permite a un atacante eludir la validaci\u00f3n de IP y acceder a recursos internos, incluyendo puntos finales de metadatos de instancias en la nube. La funci\u00f3n getLogoFromUrl() valida la URL resolviendo el nombre de host y comprobando si la direcci\u00f3n IP resultante est\u00e1 en un rango privado o reservado usando FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. Sin embargo, la petici\u00f3n cURL subsiguiente est\u00e1 configurada con CURLOPT_FOLLOWLOCATION = true y CURLOPT_MAXREDIRS = 3, lo que significa que la petici\u00f3n seguir\u00e1 las redirecciones HTTP sin revalidar la direcci\u00f3n IP de destino. Este problema ha sido solucionado en la versi\u00f3n 4.6.1."
    }
  ],
  "id": "CVE-2026-27479",
  "lastModified": "2026-06-17T10:27:13.483",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27479",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-02-24T18:24:13.699741Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-02-21T09:15:53.923",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ellite/Wallos/commit/76a53df9cb4658123b8f0b7cf1826f1ba7d1c960"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/ellite/Wallos/releases/tag/v4.6.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-fgmf-7g5v-jmjg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}