SSRF in Ellite Wallos

CVE-2026-33407

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking…

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.001 (25.3th percentile) — read the EPSS interpretation.

Affected products

Ellite Wallos — versions < 4.7.0

Weakness classification (CWE)

References

https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc (x_refsource_CONFIRM)
https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef#diff-d77202c5d47a3d7d4586e519f6f5e256da5fb2969fa8b9c75c399b2821e9de40 (x_refsource_MISC)