---
id: CVE-2026-77348
title: 'Wallos is an open-source, self-hostable personal subscription tracker'
summary: >-
  Wallos is an open-source, self-hostable personal subscription tracker. Prior
  to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via
  HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by
  disabling …
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-441
  - CWE-918
  - CWE-1188
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77348'
references:
  - url: >-
      https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/releases/tag/v5.0.0'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-f8j2-qm83-r2w4'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-f8j2-qm83-r2w4'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00246
epssPercentile: 0.16137
ingestedAt: '2026-09-08T22:12:30.945Z'
---

## Overview

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.