https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:46:28.475428+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-61639 CVE-2026-61639 — Wallos: Zip Slip path traversal in database restore writes files to webroot 2026-10-07T18:46:28.476623+00:00

Affected: ellite Wallos

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.