PT-2026-27471 · Ellite · Wallos

Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33407

Mitre

CVSS v4.0

8.3

High

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP PROXY and HTTPS PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.

Fix

Insecure Storage of Sensitive Information

SSRF

Weakness Enumeration

CWE-922

CWE-918

Related Identifiers

CVE-2026-33407

Affected Products

Wallos

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33407 · Security Note
• https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef#diff-d77202c5d47a3d7d4586e519f6f5e256da5fb2969fa8b9c75c399b2821e9de40 · Note
• https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc · Note