CVE-2026-77351

Received Received - Intake

SMTP Server-Side Request Forgery in Wallos

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-77351

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	to 5.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Wallos before version 5.0.0 allows authenticated users to set an arbitrary SMTP host in email notification settings, including private or cloud-metadata IP addresses. When the notification cron job runs, it connects to the specified host without server-side SSRF validation, enabling attackers to probe internal network services from the server.

Detection Guidance

Check Wallos version for outdated installations. Monitor outbound TCP connections from the Wallos server, especially to private or cloud-metadata IP addresses. Review email notification settings for suspicious SMTP hosts.

Impact Analysis

An attacker could exploit this to scan internal networks, identify vulnerable services, or exfiltrate data by forcing the server to connect to attacker-controlled addresses. This could lead to further attacks or data breaches.

Compliance Impact

This vulnerability may violate compliance requirements by enabling unauthorized network access or data exfiltration, potentially breaching GDPR (data protection) or HIPAA (health data privacy) if sensitive data is exposed.

Mitigation Strategies

Upgrade Wallos to version 5.0.0 or later. Remove any unauthorized SMTP host entries in email notification settings. Implement network-level restrictions to block outbound connections to private IP ranges.

Hi! I’m here to help you understand CVE-2026-77351. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70