CVE-2026-33407: falha de alta gravidade em ellite Wallos
Wallos: SSRF via HTTP Proxy Environment Variable
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.4%
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ellite · WallosCVEs relacionadas — ellite Wallos
No mesmo produto, das mais perigosas para as menos.
CVE-2026-30828HIGHWallos: SSRF via url parameter leading to File TraversalEPSS 0.6%CVE-2026-54600HIGHWallos: Unauthenticated database replacement via import endpoint on fresh installEPSS 0.6%CVE-2026-61640HIGHWallos: SSRF via OIDC Token/UserInfo URL ConfigurationEPSS 0.5%CVE-2026-61641HIGHWallos: OIDC account takeover via email-based account linking without `email_verified` checkEPSS 0.5%CVE-2026-30840HIGHWallos: Server-Side Request Forgery (SSRF) in Notification TestersEPSS 0.5%CVE-2026-61639HIGHWallos: Zip Slip path traversal in database restore writes files to webrootEPSS 0.5%