Wallos hosts a public endpoint at endpoints/payments/search.php that passes the HTTP_PROXY or HTTPS_PROXY environment variable straight into the cURL proxy setting. This design flaw enables an attacker to specify an arbitrary external address for the server to connect to, yielding a Server Side Request Forgery vulnerability. The weakness relies on the use of untrusted input for proxy configuration (CWE‑1188), the passing of environment variables to external libraries (CWE‑441), and the resulting SSRF capability (CWE‑918).

The vulnerability affects the open‑source personal subscription tracker Wallos, developed by ellite. All releases prior to version 5.0.0 are impacted because the payments/search.php endpoint was not hardened against proxy configuration. Version 5.0.0 and later include the fix that disables cURL proxying for this endpoint.

The CVSS score of 8.2 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker can trigger the flaw by sending an unauthenticated HTTP request from the internet to the affected endpoint, and no additional privileges are required. The lack of authentication combined with the ability to direct outbound server requests increases the likelihood and impact of exploitation.