High severityNVD Advisory· Published Aug 31, 2026· Updated Sep 8, 2026

CVE-2026-61639

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ellite/Wallosllm-fuzzy
Range: <4.9.6

Patches

Vulnerability mechanics

References

github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3nvd
github.com/ellite/Wallos/pull/1092nvd
github.com/ellite/Wallos/releases/tag/v4.9.6nvd
github.com/ellite/Wallos/security/advisories/GHSA-3vg2-cxpg-m43gnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000