CVE-2026-77348: Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPTPROXY = '' + CURLOPTNOPROXY = ''). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTPPROXY/HTTPSPROXY environment variable straight into CURLOPTPROXY. This issue has been patched in version 5.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 5.0.0 - Configuration
Apply the CVE-2026-33407 hardening to the endpoints/payments/search.php cURL usage by disabling proxying (set CURLOPT_PROXY to an empty value and set CURLOPT_NOPROXY to '*') so HTTP_PROXY/HTTPS_PROXY environment variables are not passed through to CURLOPT_PROXY.
Wallos endpoints/payments/search.php CURLOPT_PROXY and CURLOPT_NOPROXY = CURLOPT_PROXY = '' ; CURLOPT_NOPROXY = '*'
Event History
Frequently Asked Questions
Which deployments are exposed?
Wallos deployments running a version before 5.0.0 are affected if the application environment provides an HTTP_PROXY or HTTPS_PROXY value. The affected endpoint is endpoints/payments/search.php and is unauthenticated.
What does an attacker need to exploit this issue?
An attacker only needs network access to the unauthenticated endpoints/payments/search.php endpoint. No authentication or user interaction is required; exploitation relies on Wallos passing the HTTP_PROXY or HTTPS_PROXY environment variable to cURL.
How can I tell whether my instance is affected?
Check whether Wallos is older than version 5.0.0 and whether its runtime environment defines HTTP_PROXY or HTTPS_PROXY. Also verify whether endpoints/payments/search.php lacks cURL proxy hardening with CURLOPT_PROXY set to an empty value and CURLOPT_NOPROXY set to '*'.
What can be done before upgrading?
Remove or unset HTTP_PROXY and HTTPS_PROXY from the Wallos application environment. Restrict access to the unauthenticated endpoint where possible, then upgrade to version 5.0.0.