VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Mar 24, 2026· Updated Jun 17, 2026

CVE-2026-33407

CVE-2026-33407

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Wallosapp/Wallos
    cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*
    Range: <4.7.0
  • Wallos/Wallosllm-fuzzy
    Range: <4.7.0
  • Ellite/Wallosllm-fuzzy2 versions
    <4.7.0+ 1 more
    • (no CPE)range: <4.7.0
    • (no CPE)range: < 4.7.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.