CVE-2026-30841: Wallosapp Wallos XSS Vulnerability

CVE-2026-30841 Overview

CVE-2026-30841 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Wallos, an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the passwordreset.php file outputs user-controlled $_GET["token"] and $_GET["email"] parameters directly into HTML input value attributes without proper sanitization. The vulnerable code uses PHP's short echo syntax (<?= $token ?> and <?= $email ?>) without calling htmlspecialchars(), allowing attackers to break out of the attribute context and inject malicious scripts.

Critical Impact

Attackers can craft malicious URLs that, when clicked by authenticated users, execute arbitrary JavaScript in the victim's browser context. This could lead to session hijacking, credential theft, or unauthorized actions on behalf of the user.

Affected Products

• Wallosapp Wallos versions prior to 4.6.2
• Self-hosted Wallos instances using vulnerable passwordreset.php
• Any deployment of Wallos without the security patch from commit e8a513591dbbf885966e2ef55c38622785b9060d

Discovery Timeline

• 2026-03-07 - CVE-2026-30841 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30841

Vulnerability Analysis

This reflected XSS vulnerability exists in the password reset functionality of Wallos. The passwordreset.php file accepts token and email parameters via GET requests and directly embeds these values into HTML input elements without proper output encoding. When user-supplied data is inserted into HTML attributes without escaping special characters like double quotes, angle brackets, and ampersands, an attacker can craft input that breaks out of the intended attribute context.

The vulnerability is network-accessible and requires no authentication, though successful exploitation depends on social engineering a victim into clicking a malicious link. The impact is primarily on integrity, as attackers can modify page content or perform actions on behalf of users.

Root Cause

The root cause is improper output encoding in the PHP template. The developers used PHP's short echo syntax (<?= $token ?> and <?= $email ?>) to output user-controlled GET parameters directly into HTML value attributes. Without calling htmlspecialchars() or an equivalent encoding function, special HTML characters remain unescaped, creating an injection point.

In PHP, the secure approach would be to use htmlspecialchars($token, ENT_QUOTES, 'UTF-8') which converts characters like ", <, >, and & into their HTML entity equivalents, preventing attribute breakout attacks.

Attack Vector

The attack exploits the network-accessible password reset page. An attacker constructs a URL with a malicious payload in either the token or email parameter. The payload would typically include a double quote to escape the attribute context, followed by an event handler or script tag.

For example, an attacker could inject content like " onfocus="alert(document.cookie) into the email parameter, which would break out of the value attribute and add an event handler to the input element. When a victim clicks the malicious link and interacts with the page, the injected JavaScript executes in their browser context with full access to the page's DOM and any session cookies.

The attack requires user interaction (clicking a malicious link) but no prior authentication or privileges on the target system.

Detection Methods for CVE-2026-30841

Indicators of Compromise

• Unexpected URL parameters in passwordreset.php requests containing HTML special characters like ", <, >, or JavaScript event handlers
• Access logs showing suspicious query strings to /passwordreset.php with encoded payloads (%22, %3C, %3E)
• Reports of users receiving suspicious password reset links from unknown sources
• Browser console errors or unexpected script executions on the password reset page

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in URL parameters
• Monitor server access logs for requests to passwordreset.php containing suspicious characters or encoded JavaScript
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Use intrusion detection systems configured with XSS signature detection for incoming HTTP requests

Monitoring Recommendations

• Enable detailed logging for the password reset endpoint to capture full query string parameters
• Configure alerting for unusual patterns of password reset page access from single IP addresses
• Implement browser-side monitoring using CSP report-uri to capture policy violations
• Review referrer logs for password reset page access originating from external or suspicious domains

How to Mitigate CVE-2026-30841

Immediate Actions Required

• Upgrade Wallos to version 4.6.2 or later immediately
• Review server logs for potential exploitation attempts targeting passwordreset.php
• If unable to upgrade immediately, implement the workarounds described below
• Notify users to avoid clicking password reset links from untrusted sources

Patch Information

The vulnerability has been patched in Wallos version 4.6.2. The fix is available in GitHub commit e8a513591dbbf885966e2ef55c38622785b9060d. Users should upgrade to the latest release v4.6.2 which includes the security patch. For complete details, refer to the GitHub Security Advisory GHSA-75hc-fc26-9797.

Workarounds

• Implement a reverse proxy or WAF rule to filter or sanitize token and email parameters before they reach the application
• If modifying the source is possible, manually add htmlspecialchars() calls around the vulnerable output statements in passwordreset.php
• Restrict access to the password reset functionality to trusted networks if feasible
• Deploy Content Security Policy headers with strict-dynamic or nonce-based script-src directives to mitigate XSS impact

# Example Apache mod_rewrite rule to block suspicious characters in passwordreset.php parameters
# Add to .htaccess or Apache configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} (token|email)=.*(%22|%3C|%3E|"|<|>) [NC]
RewriteRule ^passwordreset\.php$ - [F,L]