Wallos, an open‑source subscription tracker, permits attackers to set the HTTP_PROXY and HTTPS_PROXY environment variables for the search.php endpoint. Because the application performs DNS resolution on user‑supplied search terms without validating these variables, an attacker can trigger arbitrary outbound requests to internal or external hosts. This grants server‑side request forgery, enabling network probing, data exfiltration or potentially remote code execution against vulnerable services. The flaw corresponds to CWE‑918 (Server Side Request Forgery) and CWE‑922 (Insecure Direct Object References).

All releases of Wallos distributed by ellite before version 4.7.0 are affected. Users of these versions must upgrade to the patched release that sanitizes HTTP_PROXY and HTTPS_PROXY input.

The CVSS score of 8.3 designates this vulnerability as high severity, yet the EPSS indicates a very low probability of exploitation (<1%). It is not listed in the CISA KEV catalog, suggesting no widespread active exploitation. The attack requires only a crafted HTTP request to the vulnerable endpoint and does not need local or privileged access, making it a notable risk for exposed deployments.