CVE-2026-77352: Wallos SSRF Vulnerability in SMTP Settings

CVE-2026-77352 Overview

Wallos is an open-source, self-hostable personal subscription tracker. CVE-2026-77352 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Wallos versions 2.0.0 through 5.0.0. Any authenticated user without administrative privileges can coerce the server into opening arbitrary outbound SMTP connections to internal or link-local addresses. The flaw resides in the per-user email notification settings, which pass an unvalidated SMTP host directly into PHPMailer. Maintainers patched the issue in version 5.0.0.

Critical Impact
An authenticated low-privileged user can probe internal network services and link-local addresses by directing the server's SMTP connection to attacker-chosen hosts and ports.

Affected Products

Wallos versions 2.0.0 through 4.x
Wallos self-hosted deployments exposing user email notification settings
Instances relying on endpoints/notifications/saveemailnotifications.php without patching

Discovery Timeline

2026-08-31 - CVE-2026-77352 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-77352

Vulnerability Analysis

The vulnerability originates in Wallos's per-user email notification configuration. The endpoint endpoints/notifications/saveemailnotifications.php accepts user-supplied SMTP host values without SSRF validation. Authenticated users can save an arbitrary hostname or IP address, including internal ranges such as 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and link-local addresses like 169.254.169.254 used by cloud metadata services.

When the notification cron job endpoints/cronjobs/sendnotifications.php fires for a subscription reminder, it passes the stored value into PHPMailer using $mail->Host = $email['smtpAddress']. The server then establishes an outbound TCP connection to the attacker-controlled host and port. This confused-deputy behavior allows the low-privileged attacker to reach systems that are otherwise unreachable from the public network.

Root Cause

The root cause is missing input validation on the smtpAddress field. The application trusts authenticated users to supply legitimate SMTP endpoints and does not enforce an allowlist, reject private address ranges, or resolve hostnames prior to filtering.

Attack Vector

The attack requires network access to the Wallos web interface and valid user credentials. An attacker configures their notification profile to point SMTP delivery at an internal target, then waits for the cron-triggered notification to execute. Connection behavior, timing, and error responses can be used to fingerprint internal services.

text

// Patch reference from Wallos v5.0.0
// Source: https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3
// Vulnerable pattern (pre-5.0.0):
//   $mail->Host = $email['smtpAddress'];   // no SSRF validation
// Fixed in release: https://github.com/ellite/Wallos/releases/tag/v5.0.0

Detection Methods for CVE-2026-77352

Indicators of Compromise

Outbound TCP connections from the Wallos host to RFC1918, loopback, or link-local addresses on SMTP-related ports such as 25, 465, and 587
User records in the Wallos database where smtpAddress resolves to a private, loopback, or link-local IP
Cron-driven PHP-FPM or php processes initiating connections to unusual internal endpoints

Detection Strategies

Audit the Wallos database for non-public SMTP host values stored in user notification settings
Monitor web access logs for POST requests to endpoints/notifications/saveemailnotifications.php and correlate with subsequent cron execution of sendnotifications.php
Alert on egress from the Wallos container or host to metadata endpoints such as 169.254.169.254

Monitoring Recommendations

Enable egress logging at the network boundary for the Wallos host and inspect for internal destination traffic
Track PHPMailer connection failures and SMTP handshake anomalies in application logs
Baseline expected SMTP relays and alert on connections to any host outside the allowlist

How to Mitigate CVE-2026-77352

Immediate Actions Required

Upgrade Wallos to version 5.0.0 or later, which contains the fix
Review all existing user notification records and reset any smtpAddress values pointing to private or link-local ranges
Restrict egress from the Wallos host to a known list of legitimate SMTP relays

Patch Information

The issue is resolved in Wallos v5.0.0. See the GitHub Release v5.0.0, the GitHub Security Advisory GHSA-c75x-9vj6-57qj, and the GitHub Commit Update for details on the fix.

Workarounds

Place Wallos behind an egress firewall that denies traffic to RFC1918, loopback, and link-local ranges
Disable the email notification cron job until patching is complete
Restrict user registration and audit accounts to limit exposure to authenticated attackers

bash

# Example egress restriction using iptables on the Wallos host
iptables -A OUTPUT -p tcp -m multiport --dports 25,465,587 -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -p tcp -m multiport --dports 25,465,587 -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -p tcp -m multiport --dports 25,465,587 -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -p tcp -m multiport --dports 25,465,587 -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -p tcp -m multiport --dports 25,465,587 -d 169.254.0.0/16 -j REJECT