CVE-2026-77348

Received Received - Intake

SSRF via HTTP Proxy in Wallos Subscription Tracker

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-77348

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	to 5.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-441	The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

Wallos is a self-hosted subscription tracker. A vulnerability exists in an unauthenticated logo-image search endpoint (endpoints/payments/search.php) that does not properly sanitize proxy environment variables. This allows server-side request forgery (SSRF) attacks if HTTP_PROXY or HTTPS_PROXY is set, as these values are passed directly to cURL.

Detection Guidance

To detect this vulnerability, check if Wallos version 5.0.0 or later is installed. If using an older version, verify if the endpoints/logos/search.php and endpoints/payments/search.php are accessible and if HTTP_PROXY/HTTPS_PROXY environment variables are being passed to cURL requests.

Impact Analysis

An attacker could exploit this to make the server send requests to internal systems or external addresses under their control. This may lead to data exfiltration, internal network reconnaissance, or unauthorized access to services running on the server.

Compliance Impact

This SSRF vulnerability could violate GDPR by enabling unauthorized data access or exfiltration. For HIPAA, it may compromise protected health information if internal systems are accessed. Compliance depends on data exposure, but the risk is significant due to potential unauthorized access.

Mitigation Strategies

Update Wallos to version 5.0.0 or later to apply the patch for this vulnerability.

Hi! I’m here to help you understand CVE-2026-77348. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70