CVE-2026-61520
MEDIUM
MEDIUM
Priority: 0.03
BB Relevance:
63/100
Published: 2026-07-14
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
AT:
None
VC:
None
VI:
None
VA:
None
Description
Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services.
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| SimpleMachines | SMF | 2.1.0 < 2.1.8 |
| SimpleMachines | SMF | 3.0.0-alpha.1 |
| SimpleMachines | SMF | 2.1.0 < 2.1.8 |
| SimpleMachines | SMF | 3.0.0-alpha.1 |