CVE-2026-77348

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 5.0.0

Description An unauthenticated logo-image search endpoint allows Server-Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue exists because the endpoint 'endpoints/payments/search.php' fails to disable cURL proxying, allowing the HTTP PROXY and HTTPS PROXY environment variables to be passed directly into CURLOPT PROXY.

Recommendations Update to version 5.0.0. Restrict access to the 'endpoints/payments/search.php' endpoint as a temporary mitigation measure.