CVE-2026-77353

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 5.0.0

Description Authenticated users can inject arbitrary iCalendar properties and events into exported .ics feeds. This occurs because the input validation layer encodes HTML metacharacters but fails to strip CRLF (Carriage Return Line Feed) sequences in subscription names or notes. The export layer subsequently decodes these entities before writing the iCal output, allowing an attacker to break out of the VEVENT block. This enables the insertion of attacker-controlled calendar events, including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content, which are then processed by any calendar application subscribed to the feed.

Recommendations Update to version 5.0.0.