CVE-2026-33407

Summary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.

Affected Software

VendorProductVersion RangeStatus
elliteWallos< 4.7.0affected

Weaknesses

  • CWE-918: CWE-918: Server-Side Request Forgery (SSRF)
  • CWE-922: CWE-922: Insecure Storage of Sensitive Information

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

References