Vulnerability · Published Jul 14, 2026 · Assigned by VulnCheck

CVE-2026-61520Simple Machines Forum SSRF via image proxy

High 7.7

In plain English

A high-severity server-side request forgery in SMF from SimpleMachines. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services.

Affected products (as reported)

Vendor	Product	Versions
SimpleMachines	SMF	2.1.0 – before 2.1.83.0.0-alpha.1 – through 3.0.0-alpha.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

Patch Commit (v3.0) patch
Patch Commit (v2.1) patch
https://www.vulncheck.com/advisories/simple-machines-forum-ssrf-via-image-proxy third-party-advisory