CVE-2026-61639 in Wallos
Summary
by MITRE • 09/01/2026
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in Wallos prior to version 4.9.6 represents a critical path traversal and arbitrary file write flaw within the application's database restoration functionality. As an open-source, self-hostable personal subscription tracker, Wallos relies on administrative privileges for system maintenance tasks such as restoring databases from backup files. The specific point of failure occurs in the POST endpoint /endpoints/db/restore.php, which is designed to accept uploaded archive files containing database dumps and associated assets. During the processing of these archives, the application utilizes PHP's ZipArchive::extractTo() method to decompress the contents into a designated directory on the server filesystem.
The core technical flaw lies in the lack of input validation regarding file paths contained within the ZIP archive before extraction occurs. The developer failed to sanitize or validate entry names for directory traversal sequences such as ../, allowing an attacker to manipulate the destination path during the extraction process. This is not merely a standard path traversal issue where files are read outside intended directories; it escalates to arbitrary file write because the application subsequently attempts to copy specific assets, specifically logo images, from the extracted archive to a public-facing directory. The extension filter applied by the application only validates the file type during this post-extraction copying step for logos, but it does not prevent the initial extraction of maliciously named files into sensitive locations like the webroot or script directories due to the earlier lack of path validation in the ZipArchive::extractTo() call.
An authenticated administrator can exploit this vulnerability by crafting a ZIP archive that contains an entry with a name such as logos/../../endpoints/shell.php. When this archive is uploaded and processed, the extraction logic resolves the relative paths incorrectly, writing the shell.php file directly into the /endpoints/ directory of the webroot. This results in the successful deployment of a remote code execution vector on the server. The attacker gains full control over the underlying operating system through the webshell, enabling them to execute arbitrary commands, exfiltrate sensitive data stored within the subscription tracker database, and potentially pivot to other systems within the network depending on the privileges under which the web application runs.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it involves accessing files outside of the intended restricted directory through path manipulation. Furthermore, from an offensive security perspective, this technique is categorized under ATT&CK T1505.003: Web Shell, which describes the installation and execution of web shells on compromised systems for persistent access. The exploitation chain also touches upon CWE-434: Unrestricted Upload of File with Dangerous Type if one considers the broader context of file handling, although the primary mechanism here is path traversal leading to arbitrary write rather than just type confusion.
The operational impact of this vulnerability is severe, as it allows for complete compromise of the Wallos instance and potentially the host server. Since database restoration typically requires high-level administrative access, an attacker who compromises an admin account can leverage this flaw to achieve remote code execution without needing further privilege escalation steps related to file permissions or web server configuration. The persistence provided by a webshell in the endpoints directory ensures that even if other security measures are tightened, the attacker retains a foothold within the application's core logic directories.
To mitigate this vulnerability, users must upgrade Wallos to version 4.9.6 or later, where the issue has been patched. The fix likely involves implementing strict validation of file paths during the extraction phase, ensuring that all entries are resolved against an absolute base directory and checked for any traversal sequences before being written to disk. Additionally, defense-in-depth strategies should be employed, such as configuring web servers to prevent execution of PHP scripts in directories intended only for static assets like images, although this is a secondary control since the primary fix must address the application-level logic flaw. Regular auditing of file upload and extraction mechanisms against CWE-22 guidelines is recommended to prevent similar path traversal issues in other components of the software stack.