Description
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. Version 2.2.1 patches the issue.
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Prior to version 2.2.1, a Server‑Side Request Forgery vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This blind SSRF enables internal port scanning and internal API triggering capabilities.

Affected Systems

FlaskBB forum software, all releases before 2.2.1. The vulnerability is present in the get_image_info() function of the FlaskBB code base. Users deploying v2.2.0 or earlier versions are exposed until they upgrade to v2.2.1, which removes the SSRF vector.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate impact, yet the EPSS score is below 1%, suggesting a low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog. However, because the flaw requires authentication, legitimate users can enable the SSRF without triggering external alerts. Attackers would perform a blind attack, with the server silently attempting connections to the supplied URLs, making detection harder. Proper input filtering or network restrictions are necessary to mitigate this risk.

Generated by OpenCVE AI on July 30, 2026 at 16:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FlaskBB to version 2.2.1 or later, which removes the SSRF path.
  • If an upgrade is not immediately feasible, restrict the avatar URL field to allow only safe local or trusted domains, enforcing strict whitelist validation.
  • Implement outbound request controls on the hosting server to block requests to internal IP ranges and cloud metadata services.
  • Add logging for avatar URL retrieval attempts and alert on repeated failures or unexpected internal addresses.

Generated by OpenCVE AI on July 30, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xq32-9g7q-7297 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
History

Thu, 23 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Flaskbb
Flaskbb flaskbb
Vendors & Products Flaskbb
Flaskbb flaskbb

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. Version 2.2.1 patches the issue.
Title FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Flaskbb Flaskbb
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-22T14:50:37.123Z

Reserved: 2026-05-14T20:42:31.369Z

Link: CVE-2026-46556

cve-icon Vulnrichment

Updated: 2026-07-22T14:50:32.140Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T16:30:05Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)