CVE-2026-61639

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.6

Description An issue exists where the application fails to validate entry names for directory traversal sequences when processing zip files. An administrator can upload a specially crafted zip archive to the 'POST /endpoints/db/restore.php' endpoint, which uses the ZipArchive::extractTo() function. By including entries with ../ sequences, such as logos/../../endpoints/shell.php, an attacker can write a webshell directly into the webroot. The existing extension filter is ineffective because it only applies to the logo copy step after the extraction has already occurred.

Recommendations Update to version 4.9.6.