CVE-2026-41687 Details
Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the SSRF protection in endpoints/subscription/add.php (line 42) and endpoints/payments/add.php (line 40) uses an inline IP validation check (FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) that does not block CGNAT addresses (100.64.0.0/10, RFC 6598). The includes/ssrf_helper.php file explicitly defines is_cgnat_ip() to cover this gap (used by notification endpoints), but the logo/icon URL fetching in subscription and payment endpoints performs its own inline validation that misses this range. This allows authenticated users to perform Blind SSRF to internal services in Tailscale, Carrier-Grade NAT, and other environments using 100.64.0.0/10 addresses. This issue has been patched in version 4.8.1.
A server-side request forgery (SSRF) vulnerability has been identified in Wallos versions prior to 4.8.1. The issue arises in the subscription and payment endpoints, where the SSRF protection fails to properly validate IP addresses within the Carrier-Grade NAT (CGNAT) range of 100.64.0.0/10. This oversight allows authenticated users to exploit the application by sending requests to internal services through Tailscale or other CGNAT environments. The vulnerability exists because the inline IP validation does not block CGNAT addresses, leaving a gap that can be exploited.
Users can update to Wallos version 4.8.1, which addresses the SSRF vulnerability by implementing a proper validation check for CGNAT IP addresses in the affected endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ellite/Wallos/security/advisories/GHSA-4v59-hghw-7gc2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ellite/Wallos/commit/e79f28be6be0435fbc93563fb3c0e62206b48e85 | [email protected] | Source CodeVendor |
| https://github.com/ellite/Wallos/releases/tag/v4.8.1 | [email protected] | Release NotesVendor |
| https://github.com/ellite/Wallos/security/advisories/GHSA-4v59-hghw-7gc2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ellite Wallos | <= 4.8.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |