CVE-2026-61639

Wallos, an open-source self-hostable personal subscription tracker, contains a zip path traversal flaw (CWE-22) in its database restore endpoint, POST /endpoints/db/restore.php, in versions prior to 4.9.6. The endpoint calls ZipArchive::extractTo() without validating archive entry names for ../ sequences, so an administrator who uploads a crafted backup zip containing an entry such as logos/../../endpoints/shell.php causes files to be written outside the intended extraction directory and into the webroot; the file-extension filter only applies to a later logo-copy step, so it does not prevent this. By landing a webshell in the webroot, the attacker achieves remote code execution on the web server hosting the instance. Only operators of self-hosted Wallos instances running versions before 4.9.6 are affected, and exploitation requires high privileges (an authenticated administrator), limiting risk to scenarios where an admin account is compromised, an admin is less than fully trusted, or a malicious backup archive is supplied. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade Wallos to version 4.9.6 or later, which validates zip entry names during restore. If an immediate upgrade is not possible, restrict access to /endpoints/db/restore.php to trusted administrators and inspect uploaded backup archives for entry names containing ../ sequences before restoring. Administrators should also check the webroot, including the endpoints and logos directories, for unexpected PHP files that would indicate a planted webshell.