Read the docs
TI-2026-53975 Aliases CVE-2026-77353

Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Priority MEDIUM 54CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed Wallos (ellite): 5.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elliteWallosbefore 5.0.05.0.0Patch availableCNA
  • Wallos Vendorellite Affected before 5.0.0 Fixed in 5.0.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*——ellite
  • cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:* Versions — — ·ellite

Remediation

  • Fix · CNA Wallos (ellite) Fixed in 5.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77353

References

Other 3

  • TI-2026-53972 Server-side request forgery in ellite Wallos CVSS 3.1HIGH 8.2
  • TI-2026-39433 Wallos: Unauthenticated database replacement via import endpoint on fresh install CVSS 4.0HIGH 8.2
  • TI-2026-25804 Wallos: SSRF via HTTP Proxy Environment Variable CVSS 4.0HIGH 8.3
  • TI-2026-23669 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers CVSS 3.0HIGH 8.8
  • TI-2026-39431 Missing Authentication for Critical Function in wallos CVSS 3.1HIGH 7.5
  • TI-2026-39432 Wallos: OIDC state parameter never validated — login CSRF / account takeover CVSS 4.0HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences