CVE-2026-77348: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') in ellite Wallos

Wallos versions prior to 5.0.0 contain a vulnerability where the payments logo-image search endpoint (endpoints/payments/search.php) passes the HTTP_PROXY/HTTPS_PROXY environment variables directly into the cURL CURLOPT_PROXY option without disabling proxying. This allows an attacker to exploit an unintended proxy or intermediary behavior (CWE-441), similar to a previously fixed SSRF issue in another endpoint. The vulnerability enables remote attackers to potentially cause high confidentiality impact by redirecting requests through attacker-controlled proxies. The issue was fixed in version 5.0.0 by disabling proxy usage in the affected endpoint.

The vulnerability allows unauthenticated remote attackers to leverage the payments search endpoint to proxy requests via attacker-controlled HTTP_PROXY/HTTPS_PROXY environment variables. This can lead to high confidentiality impact by exposing internal resources or sensitive data through unintended proxying. Integrity impact is low, and availability is not affected. No known exploits are reported in the wild.

Upgrade Wallos to version 5.0.0 or later, where the vulnerability is patched by disabling proxy usage in the affected payments search endpoint. No other mitigation is required as the fix is official and complete.