Wallos EUVD-2026-14948

Remote unauthenticated attacker can exploit Wallos versions prior to 4.7.0 by sending crafted search requests to /endpoints/logos/search.php. The server must have HTTP_PROXY or HTTPS_PROXY environment variables set (common in containerized deployments). No victim interaction required; DNS resolution on attacker-controlled search terms triggers SSRF.

This vulnerability presents a moderate-to-high real-world risk despite the absence of a published CVSS score. The attack vector is network-based, requires no authentication, and has low attack complexity, making it trivially exploitable by any unauthenticated user with network access to the Wallos instance. The absence of CVSS and EPSS scores limits quantitative risk modeling, but the nature of SSRF vulnerabilities—enabling attackers to probe internal networks, access internal services, or exfiltrate data—classifies this as a significant technical impact. The vulnerability is likely automatable, allowing attackers to scan internal network ranges or target known internal services (databases, metadata endpoints, etc.). The fact that a patch is available (version 4.7.0) and a public GitHub security advisory exists (GHSA-hhjq-82f8-m6rc) elevates urgency, as proof-of-concept exploitation is probable and the attack surface includes any exposed Wallos instance. For organizations running unpatched versions in internet-facing environments, this represents a critical priority. The lack of KEV (CISA Known Exploited Vulnerabilities) designation and active exploitation reports suggests this is not yet widely weaponized, but the simplicity of the attack makes exploitation inevitable.

An attacker discovers a publicly exposed Wallos instance and sends a crafted request to endpoints/logos/search.php with a search term like 'http://192.168.1.1:8080' while having previously set HTTP_PROXY to a proxy server under their control. The application performs DNS resolution on the attacker's input, and the unvalidated proxy environment variable redirects the request through the attacker's server, allowing them to probe internal network services, enumerate internal IP ranges, or access cloud metadata endpoints (e.g., 169.254.169.254 on AWS). Since the endpoint is unauthenticated and the attack requires only network access, exploitation can be automated and scaled across multiple targets.