Skip to content
Heist/ feed
Back to feed
High

Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

Type: advisorySources: OSV

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-61638
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 19:01 UTC · Revision 1

Source evidence

Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

core-osv · Original source

Published 31 Aug 2026, 20:41 UTC

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.

osv:CVE-2026-61638
Complete source record
{
  "id": "59993894d1b0f859a1efcf68a8e30c38cbc5c0a09ab5ac4a952c5221b53fa247",
  "url": "https://osv.dev/vulnerability/CVE-2026-61638",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port",
    "summary": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.",
    "evidence": "osv:CVE-2026-61638",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-61638",
      "aliases": [
        "CVE-2026-61638",
        "GHSA-f8r5-v75m-385h"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/ellite/wallos",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "02826761b0e7b94d40f23f1511dcfcd563aa6ee6"
                },
                {
                  "fixed": "b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.9.6"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "02826761b0e7b94d40f23f1511dcfcd563aa6ee6"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v4.9.6"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.9.5",
            "v4.9.4",
            "v4.9.3",
            "v4.9.2",
            "v4.9.1",
            "v4.9.0",
            "v4.8.4",
            "v4.8.3",
            "v4.8.2",
            "v4.8.1",
            "v4.8.0",
            "v4.7.3",
            "v4.7.2",
            "v4.7.1",
            "v4.7.0",
            "v4.6.2",
            "v4.6.1",
            "v4.6.0",
            "v4.5.0",
            "v4.4.1",
            "v4.4.0",
            "v4.3.0",
            "v4.2.0",
            "v4.1.1",
            "v4.1.0",
            "v4.0.0",
            "v3.3.1",
            "v3.3.0",
            "v3.2.0",
            "v3.1.1",
            "v3.1.0",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "v2.52.2",
            "v2.52.1",
            "v2.52.0",
            "v2.51.1",
            "v2.51.0",
            "v2.50.1",
            "v2.50.0",
            "v2.49.1",
            "v2.49.0",
            "v2.48.1",
            "v2.48.0",
            "v2.47.1",
            "v2.47.0",
            "v2.46.1",
            "v2.46.0",
            "v2.45.2",
            "v2.45.1",
            "v2.45.0",
            "v2.44.1",
            "v2.44.0",
            "v2.43.1",
            "v2.43.0",
            "v2.42.2",
            "v2.42.1",
            "v2.42.0",
            "v2.41.0",
            "v2.40.0",
            "v2.39.1",
            "v2.39.0",
            "v2.38.3",
            "v2.38.2",
            "v2.38.1",
            "v2.38.0",
            "v2.37.1",
            "v2.37.0",
            "v2.36.2",
            "v2.36.1",
            "v2.36.0",
            "v2.35.0",
            "v2.34.0",
            "v2.33.1",
            "v2.33.0",
            "v2.32.0",
            "v2.31.1",
            "v2.31.0",
            "v2.30.1",
            "v2.30.0",
            "v2.29.2",
            "v2.29.1",
            "v2.29.0",
            "v2.28.0",
            "v2.27.3",
            "v2.27.2",
            "v2.27.1",
            "v2.27.0",
            "v2.26.0",
            "v2.25.0",
            "v2.24.1",
            "v2.24.0",
            "v2.23.2",
            "v2.23.1",
            "v2.23.0",
            "v2.22.1",
            "v2.22.0",
            "v2.21.3",
            "v2.21.2",
            "v2.21.1",
            "v2.21.0",
            "v2.20.1",
            "v2.20.0",
            "v2.19.3",
            "v2.19.2",
            "v2.19.1",
            "v2.19.0",
            "v2.18.0",
            "v2.17.0",
            "v2.16.1",
            "v2.16.0",
            "v2.15.0",
            "v2.14.2",
            "v2.14.1",
            "v2.14.0",
            "v2.13.0",
            "v2.12.0",
            "v2.11.2",
            "v2.11.1",
            "v2.11.0",
            "v2.10.0",
            "v2.9.0",
            "v2.8.0",
            "v2.7.0",
            "v2.6.1",
            "v2.6.0",
            "v2.5.2",
            "v2.5.1",
            "v2.5.0",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.0",
            "v2.2.0",
            "v2.1.0",
            "v2.0.0",
            "v1.29.1",
            "v1.29.0",
            "v1.28.0",
            "v1.27.2",
            "v1.27.1",
            "v1.27.0",
            "v1.26.2",
            "v1.26.1",
            "v1.26.0",
            "v1.25.1",
            "v1.25.0",
            "v1.24.0",
            "v1.23.0",
            "v1.22.0",
            "v1.21.1",
            "v1.21.0",
            "v1.20.2",
            "v1.20.1",
            "v1.20.0",
            "v1.19.0",
            "v1.18.3",
            "v1.18.2",
            "v1.18.1",
            "v1.18.0",
            "v1.17.3",
            "v1.17.2",
            "v1.17.1",
            "v1.17.0",
            "v1.16.3",
            "v1.16.2",
            "v1.16.1",
            "v1.16.0",
            "v1.15.3",
            "v1.15.2",
            "v1.15.1",
            "v1.15.0",
            "v1.14.1",
            "v1.14.0",
            "v1.13.0",
            "v1.12.1",
            "v1.12.0",
            "v1.11.3",
            "v1.11.2",
            "v1.11.1",
            "v1.11.0",
            "v1.10.0",
            "v1.9.1",
            "v1.9.0",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.0",
            "v1.6.0",
            "v1.5.0",
            "v1.4.1",
            "v1.4.0",
            "v1.3.1",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.1",
            "v1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61638.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:31.700294013Z",
      "provider": "osv",
      "references": [
        "https://github.com/ellite/Wallos/releases/tag/v4.9.6",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61638.json",
        "https://github.com/ellite/Wallos/security/advisories/GHSA-f8r5-v75m-385h",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-61638",
        "https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3",
        "https://github.com/ellite/Wallos/pull/1092"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-918"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61638.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-61638",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 498595,
  "published_at": "2026-08-31T20:41:04.513+00:00"
}