Blombooru’s administrator‑only image‑proxy endpoint does not validate the target URL sufficiently, allowing an SSRF attack that can contact private or loopback addresses. An authenticated administrator can issue requests that reach internal services, cloud metadata endpoints, or other resources on the network, potentially exposing IAM credentials or other sensitive data. The vulnerability is limited to users with administrator privileges, but once such access is achieved the attacker can use the proxy to enumerate internal services and retrieve information beyond the intended trust boundary.

The weakness exists in the Blombooru developed by Mrblomblo, affecting all releases before version 1.40.0. Any deployment of Blombooru older than 1.40.0 that exposes the /api/booru-import/proxy‑image endpoint is susceptible. The vulnerability was addressed in the 1.40.0 release.

The CVSS score of 6.2 indicates a moderate severity vulnerability. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the absence of known public exploits suggests a lower current risk. The vulnerability can be exploited only by administrators, meaning the attack vector requires privileged access to the application. Because the SSRF can reach internal or private IP ranges and follow redirects, a successful exploitation could expose sensitive cloud or network credentials. The issue is not listed in CISA’s KEV catalog, reducing the immediate concern of widespread exploitation, but the potential for internal data exposure makes the risk significant for organizations that host Blombooru on private infrastructure.