CVE-2026-30841 Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php
Attackers can execute arbitrary scripts in victim browsers via reflected XSS in the password reset page, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30841?
CVE-2026-30841 is a medium-severity cross-site scripting vulnerability in ellite Wallos, published on 7 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> without calling htmlspecialchars(). This allows reflected XSS by breaking out of the attribute context. This issue has been patched in version 4.6.2.
Weakness: CWE-79
Which versions are affected by CVE-2026-30841?
It affects 1 product.
Products include Wallosapp Wallos.
How do I fix CVE-2026-30841?
No fix has been published for CVE-2026-30841 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-30841 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30841 exists.
Other vulnerabilities in ellite Wallos
Sources
Also known as GHSA-75hc-fc26-9797.