CVE-2026-61520
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contain a server-side request forgery vulnerability in the image proxy. Authenticated attackers can embed attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private, loopback, or link-local ranges, leveraging SMF's automatic HMAC signature generation.
Risk Assessment
An attacker can target internal services such as cloud instance metadata endpoints, internal web applications, and container network services, potentially leading to credential leakage or further exploitation. Authentication on the forum is required.
Recommendation
Update SMF to version 2.1.8 or later (commit 4bf35cf for 3.0). Until patched, consider disabling the image proxy or restricting the server's network access to internal services.
Other vulnerabilities in Simple Machines Forum
See all- CVE-2026-43621High
Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.
- CVE-2026-39903High
In Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8, there is an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php. A single-character operator error causes the permission check to always pass regardless of user permissions.
Original NVD description (English source)
Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS