CVE-2026-41688

7.7 Élevée

Publiée le 07/05/2026 à 17:16 · Modifiée le 17/06/2026 à 12:47 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.

Traduire en français

Produits concernés

ellite Wallos

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.7 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef
https://github.com/ellite/Wallos/security/advisories/GHSA-h4g7-xv3v-q73g

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories