CVE-2026-61520

Simple Machines Forum contains a server‑side request forgery flaw in its image proxy. The proxy accepts URLs embedded in BBCode image tags and fetches the referenced resource without validating the resolved destination against private address ranges, automatically generating HMAC signatures for any image URL. Authenticated users can create signed proxy requests targeting internal services, such as cloud instance metadata endpoints, internal web applications, and container network services, allowing the attacker to interact with resources that should be inaccessible from the public internet. This vulnerability is classified as CWE‑918, Server‑Side Request Forgery.

The affected vendor is SimpleMachines, product SMF. Versions of SMF 2.1.x before 2.1.8 and SMF 3.0.x before the inclusion of commit 4bf35cf are vulnerable.

With a CVSS score of 6 moderate severity. The EPSS score is less than 1% and the issue is not listed in CISA’s KEV catalog, indicating a low reported exploitation probability. However, exploitation requires an authenticated user who can embed arbitrary URLs in image tags. The attacker would need to set up a signed proxy request that resolves to a private internal address; once executed, the attacker could access sensitive internal resources, potentially exfiltrating information or executing further attacks from within the protected network.