CVE-2026-30841 in Wallos
Summary
by MITRE • 03/07/2026
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> without calling htmlspecialchars(). This allows reflected XSS by breaking out of the attribute context. This issue has been patched in version 4.6.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/12/2026
The vulnerability identified as CVE-2026-30841 affects Wallos, an open-source personal subscription tracking application designed for self-hosting environments. This application enables users to manage and monitor their subscription expenses by tracking various services and payments. The security flaw exists within the password reset functionality of the application's passwordreset.php component, which serves as a critical entry point for user authentication recovery processes. The vulnerability represents a significant concern for organizations and individuals relying on this self-hosted solution for financial tracking and subscription management.
The technical implementation flaw stems from improper output sanitization within the passwordreset.php script where the application directly incorporates user-supplied parameters into HTML markup without adequate encoding or escaping mechanisms. Specifically, the script employs PHP's short echo tags <?= $token ?> and <?= $email ?> to populate HTML input field values with the $_GET parameters containing the token and email address. This direct insertion pattern fails to invoke htmlspecialchars() function or equivalent sanitization measures, creating an exploitable condition that allows attackers to inject malicious content into the HTML context. The vulnerability manifests as reflected cross-site scripting because the malicious input is immediately reflected back to the user's browser without proper context escaping, enabling attackers to break out of the HTML attribute context and inject arbitrary JavaScript code.
The operational impact of this reflected XSS vulnerability extends beyond simple script execution within the victim's browser environment. Attackers can leverage this weakness to perform session hijacking, steal user credentials, manipulate the application's interface, or redirect users to malicious websites. The vulnerability specifically affects the password reset functionality, making it particularly dangerous as attackers could potentially intercept and exploit reset tokens to gain unauthorized access to user accounts. The reflected nature of the vulnerability means that exploitation requires a victim to click on a malicious link containing the crafted payload, typically delivered through phishing campaigns or compromised web pages. This makes the attack vector particularly insidious as it can be executed through social engineering techniques that trick users into visiting malicious links while using the application's password reset feature.
The remediation for this vulnerability involves implementing proper output encoding mechanisms within the passwordreset.php script. The solution requires modifying the code to sanitize user-supplied input before embedding it into HTML attributes by calling htmlspecialchars() with appropriate flags such as ENT_QUOTES or ENT_HTML5 to prevent HTML context escape sequences. This aligns with established security practices outlined in the CWE-79 category for Cross-site Scripting vulnerabilities and follows the ATT&CK framework's mitigation strategies for web application security. The fix should ensure that all user-controllable data is properly escaped when rendered in HTML contexts, particularly within attribute values where the risk of context escape is highest. Security teams should also implement comprehensive input validation and output encoding practices across all application components to prevent similar vulnerabilities from arising in other areas of the codebase. Version 4.6.2 of Wallos includes this critical fix, making it essential for users to upgrade to this release or later to maintain application security and protect against potential exploitation attempts.