CVE-2026-61520
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery (SSRF) vulnerability in the image proxy. Authenticated attackers can embed attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses.
Risk Assessment
Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services. This could lead to sensitive data leakage or further attacks within the internal network.
Recommendation
Immediately update Simple Machines Forum to a version containing commit 4bf35cf (for 2.1) or b4d23df (for 3.0). As a temporary workaround, restrict access to the image proxy or deploy WAF rules blocking requests to private IP address ranges.
Other vulnerabilities in Simple Machines Forum
See all- CVE-2026-43621High
Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.
- CVE-2026-39903High
In Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8, there is an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php. A single-character operator error causes the permission check to always pass regardless of user permissions.
Original NVD description (English source)
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services.