CVE-2026-54600

COMPONENT VERSION RANGE

NewScan fingerprints Wallos from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-01 (/daily-cve). THREE Wallos rows for eight same-day CVEs, split by FIXED RELEASE and not one row per id: eight rows would be eight findings that all say 'upgrade', and one row would tell a 4.9.5 install it still has the bugs it patched. This is the 4.9.4 set. CVE-2026-54600 (8.2) is endpoints/db/import.php with no authentication at all - its only guard is a user-table row count, so an attacker who reaches it can replace the database; CVE-2026-54598 (7.5) is the same shape on endpoints/db/migrate.php, which runs schema migrations for an anonymous caller; CVE-2026-54599 (7.5) is login.php generating an OIDC state nonce into $_SESSION and then never checking it on the callback. VERSION-MATCH ONLY on all three: the import and migrate paths are POST-only writes into somebody's live database, which is not a probe this scanner may send, and the OIDC arm needs a provider round trip. The version arrives from the tech_signatures "Wallos" row added the same day (the anonymous /login.php asset cache-buster); the gate was measured against bellamy/wallos:latest -> 5.4.5, where all three rows correctly stayed silent.