CVE-2026-33407: Wallos: SSRF via HTTP Proxy Environment Variable
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTPPROXY and HTTPSPROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33407?
CVE-2026-33407 is classified as a medium-severity vulnerability due to its potential for information disclosure through SSRF.
How do I fix CVE-2026-33407?
To fix CVE-2026-33407, upgrade Wallos to version 4.7.0 or later, which properly validates the HTTP_PROXY and HTTPS_PROXY environment variables.
What systems are affected by CVE-2026-33407?
CVE-2026-33407 affects Wallos versions prior to 4.7.0, specifically its endpoints that handle HTTP and HTTPS proxy variables.
How does CVE-2026-33407 exploit a system?
CVE-2026-33407 exploits a system by allowing attackers to use unvalidated HTTP_PROXY or HTTPS_PROXY environment variables to perform SSRF attacks.
What is SSRF in the context of CVE-2026-33407?
In the context of CVE-2026-33407, SSRF (Server-Side Request Forgery) allows an attacker to interact with internal services by tricking the server into making requests on behalf of the attacker.