CVE-2026-77348: Wallos SSRF Vulnerability

CVE-2026-77348 Overview

Wallos is an open-source, self-hostable personal subscription tracker. CVE-2026-77348 is a Server-Side Request Forgery (SSRF) vulnerability affecting all versions prior to 5.0.0. The flaw exists in the unauthenticated endpoints/payments/search.php logo-image search endpoint, which passes the HTTP_PROXY and HTTPS_PROXY environment variables directly into CURLOPT_PROXY. A previous fix for CVE-2026-33407 hardened the sibling endpoint endpoints/logos/search.php by disabling cURL proxying, but the payments endpoint was overlooked. The issue is patched in version 5.0.0.

Critical Impact
Remote unauthenticated attackers can coerce the Wallos server into routing outbound cURL requests through attacker-controlled proxies, enabling interception of sensitive HTTP traffic and internal network reconnaissance.

Affected Products

Wallos (open-source self-hostable subscription tracker)
All versions prior to v5.0.0
Endpoint: endpoints/payments/search.php

Discovery Timeline

2026-08-31 - CVE-2026-77348 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-77348

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery variant classified under [CWE-441] (Unintended Proxy or Intermediary). Wallos ships two near-identical unauthenticated logo-image search endpoints. The maintainers patched endpoints/logos/search.php in response to CVE-2026-33407 by explicitly setting CURLOPT_PROXY = '' and CURLOPT_NOPROXY = '*'. The parallel endpoint endpoints/payments/search.php did not receive the same hardening. It continues to honor the HTTP_PROXY and HTTPS_PROXY process environment variables when cURL initializes its request options.

Attackers who can influence those environment variables, or trigger the endpoint in an environment where they are already set, redirect outbound requests through an arbitrary intermediary. This exposes request contents and any credentials embedded in outbound traffic.

Root Cause

The root cause is an incomplete fix. The remediation for CVE-2026-33407 addressed a single endpoint rather than centralizing the cURL request-building logic. Because endpoints/payments/search.php builds its own cURL handle and never overrides the proxy options, libcurl falls back to the standard HTTP_PROXY/HTTPS_PROXY environment variable behavior.

Attack Vector

The endpoint is reachable over the network without authentication. An attacker who controls the deployment environment, or who exploits any secondary vector that sets proxy environment variables for the PHP process, can redirect all outbound logo-fetch traffic. The impact includes disclosure of outbound request contents and use of the Wallos server as an SSRF pivot toward internal resources reachable by the attacker-controlled proxy.

text

// Vulnerable pattern (conceptual - endpoints/payments/search.php)
// cURL handle initialized WITHOUT the hardening applied to logos/search.php:
//   CURLOPT_PROXY   = ''         <-- NOT SET
//   CURLOPT_NOPROXY = '*'        <-- NOT SET
// Result: libcurl honors HTTP_PROXY / HTTPS_PROXY environment variables.

Source: GitHub Security Advisory GHSA-f8j2-qm83-r2w4

Detection Methods for CVE-2026-77348

Indicators of Compromise

Unexpected outbound cURL connections from the Wallos PHP process to hosts that are not upstream logo providers.
Presence of HTTP_PROXY or HTTPS_PROXY variables in the environment of the web server or PHP-FPM process without an approved change record.
Access log entries for endpoints/payments/search.php from unauthenticated sources followed by anomalous egress traffic.

Detection Strategies

Inspect running Wallos containers or hosts for HTTP_PROXY/HTTPS_PROXY variables using printenv or /proc/<pid>/environ.
Correlate web access logs for requests to endpoints/payments/search.php against outbound network flows from the Wallos host.
Compare deployed source against the v5.0.0 release to confirm both endpoints/logos/search.php and endpoints/payments/search.php disable cURL proxying.

Monitoring Recommendations

Alert on any outbound HTTP(S) connection from the Wallos server to destinations outside the expected logo CDN allowlist.
Log and review all HTTP requests to the endpoints/payments/search.php path.
Monitor process environment changes on hosts running Wallos containers or PHP workers.

How to Mitigate CVE-2026-77348

Immediate Actions Required

Upgrade Wallos to version 5.0.0 or later. See GitHub Release v5.0.0.
Audit the runtime environment of the Wallos process and remove any unexpected HTTP_PROXY or HTTPS_PROXY variables.
Restrict outbound egress from the Wallos host to only the domains required for logo retrieval.

Patch Information

The vulnerability is fixed in Wallos v5.0.0. The patched code aligns endpoints/payments/search.php with the earlier CVE-2026-33407 remediation by setting CURLOPT_PROXY = '' and CURLOPT_NOPROXY = '*' on the cURL handle. Review the fix in the GitHub Commit Details and the GitHub Security Advisory GHSA-f8j2-qm83-r2w4.

Workarounds

Ensure HTTP_PROXY and HTTPS_PROXY are unset in the environment used to launch the PHP interpreter or PHP-FPM pool serving Wallos.
Place Wallos behind an authenticating reverse proxy so the vulnerable endpoint cannot be reached anonymously.
Apply egress filtering at the network layer to block traffic from the Wallos host to unapproved destinations.

bash

# Unset proxy variables before starting Wallos (systemd drop-in example)
# /etc/systemd/system/php-fpm.service.d/no-proxy.conf
[Service]
Environment="HTTP_PROXY="
Environment="HTTPS_PROXY="
Environment="http_proxy="
Environment="https_proxy="

# Reload and restart
systemctl daemon-reload
systemctl restart php-fpm