CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
Authenticated users can trigger Server-Side Request Forgery via unvalidated SMTP settings in email notifications, allowing internal network probing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61638?
CVE-2026-61638 is a high-severity server-side request forgery vulnerability in ellite Wallos, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.
Weakness: CWE-918
Which versions are affected by CVE-2026-61638?
How do I fix CVE-2026-61638?
No fix has been published for CVE-2026-61638 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-61638 being exploited?
There is no known exploitation of CVE-2026-61638 in the wild and no public exploit code.
Sources
Also known as GHSA-f8r5-v75m-385h.