CVE-2026-27479 is a Server-Side Request Forgery (SSRF) vulnerability identified in Wallos, an open-source, self-hostable subscription tracking application. The vulnerability resides in the getLogoFromUrl() function, which processes user-supplied URLs for subscription and payment logo/icon uploads. The function attempts to validate the URL by resolving the hostname and verifying that the IP address does not belong to private or reserved IP ranges using PHP's FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE flags. However, the subsequent HTTP request uses cURL with CURLOPT_FOLLOWLOCATION set to true and CURLOPT_MAXREDIRS set to 3, allowing the request to follow up to three HTTP redirects without revalidating the IP addresses of the redirected URLs. This flaw enables an attacker to supply a URL that initially resolves to a valid public IP but redirects to internal IP addresses or cloud metadata service endpoints, such as those commonly found in AWS, Azure, or GCP environments. By exploiting this, attackers can access sensitive internal resources, including cloud instance metadata, which may contain credentials or configuration data. The vulnerability requires low privileges (PR:L), no user interaction, and has a CVSS v3.1 score of 7.7 (high severity), reflecting its potential for confidentiality impact without affecting integrity or availability. The issue was patched in Wallos version 4.6.1 by presumably disabling redirect following or revalidating IPs after redirects.

The SSRF vulnerability in Wallos can lead to unauthorized access to internal network resources and sensitive cloud metadata endpoints, potentially exposing credentials, configuration data, or other confidential information. This can facilitate further attacks such as privilege escalation, lateral movement within internal networks, or compromise of cloud infrastructure. Organizations using vulnerable versions of Wallos risk data breaches and unauthorized internal reconnaissance. Since Wallos is self-hosted, the impact depends on the deployment environment; cloud-hosted instances are particularly at risk due to metadata endpoint exposure. The vulnerability does not directly affect data integrity or availability but poses a significant confidentiality risk. Exploitation requires only low privileges and no user interaction, increasing the likelihood of successful attacks if the system is accessible to attackers.

To mitigate this vulnerability, organizations should immediately upgrade Wallos to version 4.6.1 or later, where the issue is fixed. If upgrading is not immediately possible, administrators should disable or restrict the logo/icon upload functionality to trusted users only. Network-level controls should be implemented to block outbound HTTP requests from the Wallos server to internal IP ranges and cloud metadata IP addresses (e.g., 169.254.169.254). Additionally, application-level hardening can include disabling cURL's CURLOPT_FOLLOWLOCATION option or implementing strict validation of URLs after each redirect to ensure they do not resolve to private or reserved IP ranges. Monitoring and logging outbound requests from the application can help detect suspicious SSRF attempts. Finally, review cloud instance metadata access policies and consider using metadata service versions that require authentication or tokens to reduce exposure.