CVE-2026-77348

CVE-2026-77348 is a second, unauthenticated server-side request forgery (SSRF) flaw in Wallos, an open-source self-hostable personal subscription tracker: the logo-image search script endpoints/payments/search.php still passes the HTTP_PROXY/HTTPS_PROXY environment variables straight into cURL's CURLOPT_PROXY, whereas the near-identical endpoints/logos/search.php was hardened against this exact issue (CURLOPT_PROXY disabled and CURLOPT_NOPROXY set) in the earlier fix for CVE-2026-33407. Any unauthenticated network request to the payments search endpoint on affected versions can trigger the flaw, particularly on deployments where proxy environment variables are configured. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), a successful attack carries high confidentiality impact and limited integrity impact, letting an attacker induce the Wallos host to send requests to internal or attacker-chosen destinations and expose internal services or data. All self-hosted Wallos deployments running any version before 5.0.0 are affected; the issue is fixed in 5.0.0. No exploitation has been observed: there is no public proof-of-concept, the EPSS 30-day probability is 0.2% (16th percentile), and the flaw is not in the CISA KEV catalog.

What to do: Upgrade to Wallos 5.0.0, which applies the same cURL proxy hardening to endpoints/payments/search.php. As an interim measure, unset or clear HTTP_PROXY and HTTPS_PROXY in the Wallos service/container environment, or manually apply the hardening used in the earlier fix (CURLOPT_PROXY = '' and CURLOPT_NOPROXY = '*') to endpoints/payments/search.php, and restrict the instance's outbound network access to limit SSRF reach.