CVE-2026-30828CWE-22CWE-29CWE-918

Wallos: SSRF via url parameter leading to File Traversal

High · published March 7, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00533 · 44.2th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-29 · Path Traversal: '\..\filename'; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-07T05:27Z
EPSS history
Timeline
  • 07 MAR 05:27Z
    Wallos: SSRF via url parameter leading to File Traversal
    cvelistv5