PT-2026-84037

CVE-2026-77348

Published

2026-08-31

Updated

2026-09-01

Description by

CVSS 3.1

8.2

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 5.0.0

Description An unauthenticated logo-image search endpoint allows Server-Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue exists because the endpoint 'endpoints/payments/search.php' fails to disable cURL proxying, allowing the HTTP PROXY and HTTPS PROXY environment variables to be passed directly into CURLOPT PROXY.

Recommendations Update to version 5.0.0. Restrict access to the 'endpoints/payments/search.php' endpoint as a temporary mitigation measure.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

CWE-1188: Initialization of a Resource with an Insecure Default

CWE-441: Unintended Proxy or Intermediary (\'Confused Deputy\')

Related identifiers