What’s Vulnerable › Vulnerabilities

CVE-2026-33407: Wallos: SSRF via HTTP Proxy Environment Variable

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-24 · updated 2026-06-17
• Weakness: CWE-918

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.

Affected products

• ellite Wallos: before 4.7.0 — fixed in 4.7.0

How to fix

Upgrade to a fixed version: ellite Wallos 4.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef#diff-d77202c5d47a3d7d4586e519f6f5e256da5fb2969fa8b9c75c399b2821e9de40
• https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc

Get alerted when CVE-2026-33407 or the next vulnerability affects your stack