Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.

CVE-2026-77348 affects Wallos, an open-source self-hostable personal subscription tracker, prior to version 5.0.0. The vulnerability is an incomplete fix for a prior SSRF issue (CVE-2026-33407), which hardened only the endpoints/logos/search.php endpoint by disabling cURL proxy settings. A second, near-identical unauthenticated endpoint, endpoints/payments/search.php, was overlooked and still passes HTTP_PROXY/HTTPS_PROXY environment variables directly into CURLOPT_PROXY, enabling Server-Side Request Forgery (SSRF) attacks. The endpoint is unauthenticated, increasing the risk of exploitation by remote, unauthenticated attackers. Attackers could leverage this to route requests through attacker-controlled proxies or access internal network resources. The issue has been fully patched in Wallos version 5.0.0. Users are advised to upgrade immediately to mitigate the risk.