CVE-2026-61520

Simple Machines Forum SSRF via image proxy

Medium6.3EPSS 0.44%

Published: 14 Jul 2026
Updated: 29 Oct 2026
Reserved: 10 Jul 2026
Assigned by: VulnCheck

Description

Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services.

Scores

CVSS scores of CVE-2026-61520, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium6.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High7.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVDNVD · Deferred	4.0	Medium6.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.44% · top 62% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

CWE-918: Server-Side Request Forgery (SSRF) (opens in a new tab)All about CWE-918 and its CVEs

Affected products

SimpleMachines · SMF
- affected 2.1.0 – < 2.1.8
- unaffected 2.1.8
- unaffected b4d23dfd74a511587c605f9d294cefc3a75b4b26
- affected 3.0.0-alpha.1 – ≤ 3.0.0-alpha.4
- unaffected 4bf35cf9e45573a5f55a6f52995086c1da89c096

References (3)

Patch Commit (v3.0) (opens in a new tab)patch
Patch Commit (v2.1) (opens in a new tab)patch
https://www.vulncheck.com/advisories/simple-machines-forum-ssrf-via-image-proxy (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-61520](https://trackcve.app/badge/CVE-2026-61520.svg)](https://trackcve.app/cve/CVE-2026-61520)

Record last updated 29 Oct 2026, 21:16 UTC.