CVE-2026-77348CWE-1188CWE-441CWE-918ssrf

CVE-2026-77348

High · published September 1, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.7th percentile
Weaknesses
CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy'); CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-01T02:17Z
References (6)
https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3 · [email protected]https://github.com/ellite/Wallos/releases/tag/v5.0.0 · [email protected]https://github.com/ellite/Wallos/security/advisories/GHSA-f8j2-qm83-r2w4 · [email protected]https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc · [email protected]https://github.com/ellite/Wallos/security/advisories/GHSA-f8j2-qm83-r2w4 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 SEP 03:39Z
    EPSS moved — → 0%
    epss
  • 31 AUG 21:15Z
    Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
    cvelistv5