CVE-2026-77348 in Wallos
Summary
by MITRE • 09/01/2026
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified as CVE-2026-33407 represents a Server-Side Request Forgery (SSRF) flaw within the Wallos personal subscription tracker application, specifically affecting versions prior to 5.0.0. SSRF vulnerabilities occur when an application retrieves data from a remote server using user-supplied input without proper validation or sanitization of the destination URL. In this context, the vulnerability stems from improper handling of HTTP proxy environment variables within specific API endpoints. The core technical flaw lies in how the PHP cURL library is configured to handle outgoing requests. When the CURLOPT_PROXY option is set based on environment variables such as HTTP_PROXY or HTTPS_PROXY without restricting the scope of allowed destinations, an attacker can manipulate these inputs to force the server to make connections to internal network resources that are otherwise inaccessible from the public internet.
The root cause of this vulnerability is a lack of consistent security hardening across similar functional endpoints within the application architecture. While one endpoint responsible for searching logos at endpoints/logos/search.php was correctly patched by disabling cURL proxying through explicit configuration settings, specifically setting CURLOPT_PROXY to an empty string and CURLOPT_NOPROXY to an asterisk wildcard, a second nearly identical endpoint located at endpoints/payments/search.php remained unpatched. This secondary endpoint handles payment-related search queries but retains the vulnerable behavior of passing HTTP_PROXY or HTTPS_PROXY environment variables directly into the cURL proxy configuration. Because this endpoint is accessible without authentication, any external actor can exploit this misconfiguration to initiate server-side requests to arbitrary internal services, such as database servers, administrative interfaces, or cloud metadata endpoints like AWS EC2 instance metadata service.
The operational impact of this SSRF vulnerability allows an unauthenticated attacker to pivot through the Wallos application and access sensitive internal network resources. By crafting specific HTTP requests that leverage the proxy environment variable handling in the payments search endpoint, attackers can read local files on the server if file protocols are supported by cURL, scan internal port ranges to map out the network topology, or interact with backend services such as Redis, MySQL, or Elasticsearch instances running on localhost or within the private subnet. This capability significantly expands the attack surface beyond simple data leakage, potentially leading to full system compromise when combined with other vulnerabilities in adjacent internal services. The presence of this flaw undermines the security posture established by the patch applied to the logo search endpoint, demonstrating a critical inconsistency in application-level defense mechanisms.
From an industry standard perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which categorizes flaws where web applications retrieve remote resources without validating user-supplied URLs. Furthermore, it maps to MITRE ATT&CK technique T1571 Non-Standard Port and potentially T1046 Network Service Discovery if used for scanning internal networks. The specific mechanism of abusing proxy environment variables relates to CWE-829 Inclusion of Functionality from Untrusted Control Sector, as the application relies on external environmental configurations that are not sufficiently constrained by the developer's security controls.
To mitigate this vulnerability, organizations running Wallos versions prior to 5.0.0 must upgrade immediately to version 5.0.0 or later, where both the logo and payment search endpoints have been hardened against SSRF attacks via proxy disabling. For environments unable to patch immediately due to dependency constraints, temporary mitigations include restricting outbound network traffic from the Wallos server using firewall rules that block access to internal IP ranges and cloud metadata services. Additionally, ensuring that HTTP_PROXY and HTTPS_PROXY environment variables are not set or are explicitly cleared within the application runtime context can prevent the exploitation of this specific cURL configuration flaw. Regular security audits should also be conducted to ensure consistency in hardening measures across all similar endpoints within web applications to prevent partial patching scenarios from leaving residual attack vectors exposed.