Skip to content
Threat Feed
Subscribe

Tag

Forum

1 brief RSS
high advisory

CVE-2026-61520 - Simple Machines Forum Server-Side Request Forgery

A server-side request forgery (SSRF) vulnerability exists in Simple Machines Forum versions 2.1 (prior to commit 4bf35cf) and 3.0 (prior to commit b4d23df) allowing authenticated attackers to embed attacker-controlled URLs in BBCode image tags, causing the image proxy to fetch these URLs without validating resolved destination IPs, leading to internal HTTP requests and valid signed proxy requests for targeting internal services like cloud instance metadata endpoints.

Simple Machines Forum 2.1 +1 server-side-request-forgery ssrf cve web-application forum
3t 1c