CVE-2026-30839 — Wallos: SSRF via webhook test endpoint
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/rese…
Published: 2026-03-07 · CVSS: 5.3 · CVSS 4.0
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in version 4.6.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7