High severity7.5NVD Advisory· Published Mar 7, 2026· Updated Jun 17, 2026

CVE-2026-30828

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2.

Affected products

Wallosapp/Wallos
cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*
Range: <4.6.2
Ellite/Wallosllm-fuzzy2 versions
<4.6.2+ 1 more
- (no CPE)range: <4.6.2
- (no CPE)range: < 4.6.2

Patches

Vulnerability mechanics

References

github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060dnvdPatch
github.com/ellite/Wallos/security/advisories/GHSA-p7qj-669r-grvcnvdExploitVendor Advisory
github.com/ellite/Wallos/releases/tag/v4.6.2nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000