Command Injection Vulnerability in Wallos Personal Subscription Tracker
CVE-2026-61639
8.5HIGH
What is CVE-2026-61639?
Wallos, a self-hostable personal subscription tracker, is susceptible to a command injection vulnerability due to improper validation of entry names during the extraction of zip files. Before version 4.9.6, the application allowed specially crafted zip files to exploit the improper use of ZipArchive::extractTo(). This can enable attackers to upload a web shell to the webroot by including paths like '../' in their zip file entries. The vulnerability compromises the integrity of the application and potentially allows unauthorized access to the server. Users are advised to upgrade to version 4.9.6 or later, where this issue has been addressed.
Affected Version(s)
Wallos < 4.9.6