CVE-2026-61639 Overview
Wallos is an open-source, self-hostable personal subscription tracker. Versions prior to 4.9.6 contain a path traversal vulnerability [CWE-22] in the database restore endpoint. The POST /endpoints/db/restore.php handler calls ZipArchive::extractTo() on admin-supplied archives without validating entry names for ../ sequences. An authenticated administrator can upload a crafted zip whose entry path resolves outside the intended extraction directory, writing a PHP webshell into the webroot. The extension filter that guards the post-extraction logo copy step does not run during extraction itself, so it fails to block the traversal. The issue is patched in Wallos version 4.9.6.
Critical Impact
Authenticated administrators can achieve remote code execution on the Wallos host by uploading a malicious backup archive containing a traversal-crafted entry name.
Affected Products
- Wallos self-hosted subscription tracker versions prior to 4.9.6
- Deployments exposing the admin POST /endpoints/db/restore.php endpoint
- Container and bare-metal installations sharing the web-writable directory
Discovery Timeline
- 2026-08-31 - CVE-2026-61639 published to NVD
- 2026-09-01 - Last updated in NVD database
- Wallos v4.9.6 - Fixed release published by the Wallos project
Technical Details for CVE-2026-61639
Vulnerability Analysis
The vulnerable code path lives in the backup restore feature. The endpoint accepts a zip archive from an authenticated administrator and hands it to PHP's ZipArchive::extractTo() without inspecting each entry name. ZipArchive::extractTo() does not sanitize traversal sequences on its own. Any entry that includes ../ will be written relative to the extraction root, potentially landing anywhere the PHP process can write. Because the Wallos webroot is writable by the same process, an attacker can drop an executable PHP file that the web server subsequently serves.
The existing extension filter runs only during the follow-on step that copies files from the extracted logos/ directory to their final location. That filter never sees the traversal-crafted entry because the malicious file has already been placed outside logos/. The result is arbitrary file write inside the webroot, which chains directly to remote code execution.
Root Cause
The root cause is missing validation of archive entry names before extraction. The application trusts the archive contents implicitly and relies on a downstream filter that only inspects a subset of extracted files. This is a canonical Zip Slip pattern classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Attack Vector
Exploitation requires administrator credentials on the Wallos instance. The attacker crafts a zip archive containing an entry named logos/../../endpoints/shell.php with PHP payload contents. Submitting this archive to POST /endpoints/db/restore.php causes the file to be written to endpoints/shell.php in the webroot. Requesting the resulting URL executes the payload under the web server's user context, giving the attacker command execution on the host.
See the GitHub Security Advisory GHSA-3vg2-cxpg-m43g and the patch commit for the technical fix details.
Detection Methods for CVE-2026-61639
Indicators of Compromise
- Unexpected .php files appearing under the Wallos webroot, especially in endpoints/, api/, or directories writable by the web server user
- Access log entries showing POST /endpoints/db/restore.php from unusual source IPs or outside change windows
- Subsequent GET requests to newly created PHP filenames not present in the shipped Wallos release manifest
- Web server process spawning shells such as sh, bash, or python from within the Wallos install directory
Detection Strategies
- Compare files under the Wallos install directory against the file list for the deployed version and alert on additions
- Inspect backup archives uploaded to the restore endpoint and flag any entry whose normalized path escapes the extraction root
- Alert on any child process spawned by PHP-FPM or the web server whose command line references reverse-shell tooling
Monitoring Recommendations
- Forward web server access logs and file integrity monitoring events to a centralized log platform for correlation
- Baseline the set of PHP files inside the Wallos webroot and continuously monitor for deviation
- Track administrative authentication events preceding backup restore actions to identify credential compromise
How to Mitigate CVE-2026-61639
Immediate Actions Required
- Upgrade Wallos to version 4.9.6 or later, which is the fixed release published by the project
- Rotate all administrator credentials and any secrets stored inside the Wallos database if the restore endpoint was exposed
- Audit the webroot for unexpected PHP files and remove any that do not match the shipped release
- Restrict network access to the Wallos admin interface to trusted management networks only
Patch Information
The fix ships in Wallos Release v4.9.6. The remediation validates archive entry names before extraction so that traversal sequences are rejected. Review Pull Request #1092 and the patch commit for implementation details. Note that the provided commit diff also includes unrelated OIDC hardening changes; the traversal fix is applied to the restore.php extraction logic in the same release train.
Workarounds
- Disable the backup restore feature at the web server or reverse proxy layer by blocking POST /endpoints/db/restore.php until patching
- Enforce strong administrator authentication with multi-factor authentication and unique credentials per operator
- Run the Wallos PHP process under a user account without write permission to the webroot, so any dropped file cannot be executed as PHP
- Place Wallos behind a web application firewall rule that rejects multipart uploads containing zip entries with .. in their names
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
