A path traversal vulnerability in the Wallos subscription tracker allows an authenticated administrator to achieve arbitrary file write, posing a severe risk of system compromise.

The application fails to validate ZIP entry names for directory traversal sequences within the restore functionality. By crafting a ZIP file containing path traversal sequences, an attacker with administrative privileges can bypass extension filters and write a webshell to the webroot.

A successful exploitation of this vulnerability allows an attacker to gain full control over the application server. Given the CVSS score of 8.5, this is classified as a high-severity issue that could lead to complete data compromise, unauthorized access to underlying system files, and potential persistence for the attacker. The ability to write arbitrary files essentially grants the attacker the same level of access as the web server user.

Immediate Action: Update the Wallos installation to version 4.9.6 or later immediately to patch the path traversal vulnerability in the restore endpoint.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /endpoints/db/restore.php and monitor the file system for unexpected files created in the web directory.

Compensating Controls: Ensure that the web server process runs with the least privilege necessary, and use a Web Application Firewall (WAF) to inspect incoming ZIP archives for suspicious naming patterns.

Public Exploit Available: No (Exploit status is unknown).

This vulnerability represents a critical security flaw in the Wallos restoration process that could lead to full system compromise. Organizations utilizing Wallos must prioritize upgrading to version 4.9.6 to eliminate this risk. Given the high severity of path traversal vulnerabilities when used for file writes, immediate remediation is strongly advised to prevent unauthorized access.