CVE-2026-61639: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in ellite Wallos

CVE-2026-61639 is a path traversal vulnerability (CWE-22) in Wallos before version 4.9.6. The vulnerability arises because the restore.php endpoint uses ZipArchive::extractTo() without validating for '../' sequences in zip entry names. An attacker with admin privileges can upload a crafted zip file containing entries like logos/../../endpoints/shell.php, which results in writing a webshell to the webroot directory. The extension filter intended to restrict file types only applies after extraction during a logo copy step, not preventing the initial extraction of malicious files. The vulnerability has been fixed in Wallos version 4.9.6.

An attacker with administrative privileges can exploit this vulnerability to write arbitrary files, including webshells, to the webroot directory. This can lead to remote code execution or full system compromise. The CVSS 4.0 score is 8.5 (high severity), reflecting the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

This vulnerability has been patched in Wallos version 4.9.6. Users should upgrade to version 4.9.6 or later to remediate this issue. No other mitigation guidance is provided or necessary as the fix addresses the root cause.