Which versions of PHP are affected by CVE-2026-33407?

Wallos subscription tracker versions prior to 4.7.0 contain an unauthenticated SSRF vulnerability that allows remote attackers to intercept and redirect all outbound HTTP/HTTPS traffic from affected…. A patch is available.

How to fix or mitigate CVE-2026-33407?

Within 24 hours: Identify all Wallos deployments and document their network exposure and privilege level. Within 7 days: Upgrade Wallos to version 4.7.0 or later on all instances. Within 30 days: Conduct network segmentation audit to ensure Wallos instances cannot reach sensitive internal systems, and implement proxy authentication controls if proxy usage is required.

PHP CVE-2026-33407

Q: What is the CVSS score of CVE-2026-33407?

CVE-2026-33407 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14948 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-24 GitHub_M

SSRF PHP

8.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:18 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.7.0

EUVD ID Assigned

Mar 24, 2026 - 18:15 euvd

EUVD-2026-14948

Analysis Generated

Mar 24, 2026 - 18:15 vuln.today

CVE Published

Mar 24, 2026 - 17:40 nvd

HIGH 8.3

DescriptionGitHub Advisory

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.

AnalysisAI

Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability in the endpoints/logos/search.php endpoint prior to version 4.7.0. The vulnerability allows unauthenticated attackers to hijack HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling them to redirect outbound requests to arbitrary domains by manipulating DNS resolution through user-supplied search terms. This attack requires no special privileges and can be executed remotely over the network, making it a significant risk for exposed Wallos instances.

Technical ContextAI

Wallos is a PHP-based subscription management application that processes user input in the logos search endpoint. The vulnerability stems from improper handling of proxy environment variables (HTTP_PROXY and HTTPS_PROXY), which are standard mechanisms for configuring HTTP client behavior in PHP. The root cause is classified under CWE-918 (Server-Side Request Forgery), which occurs when an application fetches remote resources based on user-controlled input without proper validation or sanitization. The search.php endpoint performs DNS resolution on user-supplied search terms to fetch logo images, but fails to restrict these requests through a whitelist or proxy validation, allowing attackers to abuse the server's network access to reach internal or external systems. The affected product is Ellite Wallos (CPE: cpe:2.3:a:ellite:wallos:*:*:*:*:*:*:*:*), a self-hosted PHP application that may be deployed in network environments where outbound requests carry elevated trust.

RemediationAI

Immediately upgrade Wallos to version 4.7.0 or later, which includes validation and sanitization of HTTP_PROXY and HTTPS_PROXY environment variables. Refer to the vendor security advisory at https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc for deployment instructions. As a temporary mitigation if immediate patching is not possible, restrict network access to the Wallos instance to trusted IP ranges using a firewall or reverse proxy, disable outbound HTTP/HTTPS from the application server except to whitelisted domains, and review environment variables to ensure proxy settings are not maliciously configured. Monitor Wallos logs for suspicious search queries or unexpected outbound connections from the application process.