Read the docs
TI-2026-25804 Aliases CVE-2026-33407

Wallos: SSRF via HTTP Proxy Environment Variable

Priority HIGH 75CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-922.

Summary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Wallos (ellite): 4.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elliteWallosbefore 4.7.04.7.0Patch availableCNA
  • Wallos Vendorellite Affected before 4.7.0 Fixed in 4.7.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*before 4.7.0Vulnerableellite
  • cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:* Versions before 4.7.0 Vulnerable ·ellite

Remediation

  • Fix · CNA Wallos (ellite) Fixed in 4.7.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33407

References

Exploit 1

Patch 1

  • TI-2026-23669 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers CVSS 3.0HIGH 8.8
  • TI-2024-19429 Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. CVSS 3.1HIGH 8.1
  • TI-2026-25796 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 CVSS 3.1HIGH 7.7
  • TI-2026-21886 Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch CVSS 3.1HIGH 7.7
  • TI-2026-25814 Wallos: Password Reset Tokens Never Expire CVSS 3.1HIGH 7.1
  • TI-2026-25798 Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php CVSS 4.0HIGH 7.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences