# CVE-2026-77348: Wallos SSRF via HTTP proxy environment variable in payments search

Source: https://junglewise.ai/threats/cve-2026-77348-wallos-ssrf-via-http-proxy-environment-variable-in-payments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77348 · Severity: high · CVSS 8.2 · Published 2026-08-31

Wallos is an open-source subscription tracker that searches for payment logos via HTTP requests. An unauthenticated attacker can manipulate environment variables on the server hosting Wallos to force logo searches through a malicious proxy, enabling them to intercept internal network traffic, access sensitive data, or attack systems that are only reachable from within the company's network. This is a critical flaw in the trust boundary between the application and its runtime environment.

## Quick answers

**Is CVE-2026-77348 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77348 being exploited in the wild.

**How severe is CVE-2026-77348?** High severity, with a CVSS score of 8.2, published 31 August 2026.

**Which products and versions are affected?** Wallos Wallos prior to 5.0.0.

**Is there a fix for CVE-2026-77348?** A patch was published on 2026-07-11: Fixed in version 5.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77348 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77348?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) flaw in the unauthenticated endpoint endpoints/payments/search.php. The endpoint performs HTTP requests using cURL and directly passes the HTTP_PROXY and HTTPS_PROXY environment variables to the CURLOPT_PROXY option without validation or hardening. Unlike the previously patched endpoint endpoints/logos/search.php, this second endpoint was not hardened against proxy-based SSRF attacks. An attacker with control over the server environment (or able to set environment variables through deployment misconfiguration or container escape) can direct all HTTP requests from this endpoint through a proxy server they control, enabling interception of requests and potential access to internal services.

## Affected products

- Wallos Wallos prior to 5.0.0

## Timeline

- 2026-08-31: disclosed
- 2026-07-11: patched: Fixed in version 5.0.0

## References

- [https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3](https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3)
- [https://github.com/ellite/Wallos/releases/tag/v5.0.0](https://github.com/ellite/Wallos/releases/tag/v5.0.0)