CVE-2026-77351

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 5.0.0

Description Authenticated users can store an arbitrary SMTP host, including private and cloud-metadata IP addresses, in their personal email notification settings due to a lack of server-side SSRF (Server-Side Request Forgery) validation. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. When the scheduled notification cron job executes, the stored host is passed directly to PHPMailer, forcing the server to open an outbound TCP connection to the specified address. This allows a low-privileged attacker to probe internal network services from the server's perspective.

Recommendations Update to version 5.0.0.