Wallos

v5.0.0 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 15d Dashboards & Home Pages

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 4 known CVEs

Topics

budgeting docker finance php self-hosted subscription-tracker

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 12d

Version 5.0.0 delivers a complete UI overhaul and several critical security patches across payment‑logo search, iCal export, SMTP handling, and calendar features.

Why it matters: The release fixes high‑severity SSRF (95) and CRLF injection (90) vulnerabilities; teams using the payments logo‑search endpoint or generating iCal exports must upgrade immediately to mitigate risk.

Summary

AI summary

Updates ⚠ BREAKING CHANGES, Bug Fixes, and 5.0.0 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Critical	Fixes SSRF vulnerability via HTTP proxy environment variable in payments logo search Fixes SSRF vulnerability via HTTP proxy environment variable in payments logo search Source: llm_adapter@2026-07-15 Confidence: high	—
Security	Critical	Prevents CRLF injection by escaping iCal property values in calendar exports Prevents CRLF injection by escaping iCal property values in calendar exports Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Honors configured outbound proxy for logo search, closing HTTPoxy SSRF bypass Honors configured outbound proxy for logo search, closing HTTPoxy SSRF bypass Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Validates per‑user SMTP host against SSRF before sending emails Validates per‑user SMTP host against SSRF before sending emails Source: llm_adapter@2026-07-15 Confidence: high	—
Breaking	High	complete ui overhaul changes application layout and interaction patterns complete ui overhaul changes application layout and interaction patterns Source: llm_adapter@2026-07-15 Confidence: low	—
Feature
Feature	Medium	Introduces v2.0 API write endpoints for programmatic interaction Introduces v2.0 API write endpoints for programmatic interaction Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds option to set week start as Sunday in calendar settings Adds option to set week start as Sunday in calendar settings Source: llm_adapter@2026-07-15 Confidence: low	—
Feature	Low	Allow setting beginning of week as Sunday in calendar settings Allow setting beginning of week as Sunday in calendar settings Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Feature	Low	Add dashboard icons image search functionality Add dashboard icons image search functionality Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Feature	Low	Introduce declarative OIDC settings configuration Introduce declarative OIDC settings configuration Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Feature	Low	Enable Google Image Search via SERPAPI integration Enable Google Image Search via SERPAPI integration Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Feature	Low	Provide grid view for subscription listings Provide grid view for subscription listings Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Feature	Low	Add more statistics dashboards and reports Add more statistics dashboards and reports Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Feature	Low	Implement selfh.st image search capability Implement selfh.st image search capability Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Feature	Low	Show subscription details in a popup window Show subscription details in a popup window Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Feature	Low	Translate categories using AI translation service Translate categories using AI translation service Source: granite4.1:30b@2026-07-15-audit Confidence: high	—
Bugfix
Bugfix	Medium	Ensures calendar occurrences respect subscription start date for accurate scheduling Ensures calendar occurrences respect subscription start date for accurate scheduling Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Includes today's subscriptions in “amount due this month” calculation Includes today's subscriptions in “amount due this month” calculation Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Low	Improves background removal quality for logo images Improves background removal quality for logo images Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

5.0.0 (2026-07-11)

⚠ BREAKING CHANGES

complete ui overhaul (#1108)

Features

Allow setting beginning of week as Sunday in calendar (#1010) (f01685e)
complete ui overhaul (#1108) (11eaf40)
dashboard icons image search (11eaf40)
declarative oidc settings (11eaf40)
google image search with serpapi (11eaf40)
grid view for subscriptions (11eaf40)
more statistics (11eaf40)
option for the week to start on sunday (11eaf40)
redesign login / registration pages (11eaf40)
selfh.st image search (11eaf40)
subscription details popup (11eaf40)
translate categories with ai (11eaf40)
v2.0 api - write endpoints (11eaf40)

Bug Fixes

calendar occurrences to respect subscription start date (11eaf40)
escape iCal property values to prevent crlf injection (11eaf40)
honor configured outbound proxy for logo search without reopening httpoxy SSRF bypass (11eaf40)
improve background removal feature for logos (11eaf40)
include todays subscriptions on amount due this month (11eaf40)
remove hardcode string from the admin page (11eaf40)
require cron auth guard on storetotalyearlycost.php (11eaf40)
ssrf via http proxy env var in payments logo search (11eaf40)
validate per-user smtp host against ssrf (11eaf40)

Breaking Changes

Complete UI overhaul

Security Fixes

Escape iCal property values to prevent CRLF injection
Honor configured outbound proxy for logo search without reopening HTTPoxy SSRF bypass
SSRF via http proxy env var in payments logo search
Validate per-user SMTP host against SSRF

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Wallos

Get notified when new releases ship.

About Wallos

Wallos: Open-source, self-hostable personal subscription tracker. Visualize your recurring expenses, manage your budget, and save money.