CVE-2026-61639 — Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating en…
Published: 2026-08-31 · CVSS: 8.5 · CVSS 4.0
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7