CVE-2026-61520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61520", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-10T15:43:36.628Z", "datePublished": "2026-07-14T20:17:15.901Z", "dateUpdated": "2026-10-29T21:16:07.731Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:16:07.731Z"}, "title": "Simple Machines Forum SSRF via image proxy", "descriptions": [{"lang": "en", "value": "Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services."}], "tags": ["x_open-source"], "datePublic": "2026-07-14T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/SimpleMachines/SMF", "vendor": "SimpleMachines", "product": "SMF", "repo": "https://github.com/SimpleMachines/SMF", "versions": [{"status": "affected", "version": "2.1.0", "versionType": "semver", "lessThan": "2.1.8"}, {"status": "unaffected", "version": "2.1.8", "versionType": "semver"}, {"status": "unaffected", "version": "b4d23dfd74a511587c605f9d294cefc3a75b4b26", "versionType": "git"}, {"status": "affected", "version": "3.0.0-alpha.1", "versionType": "semver", "lessThanOrEqual": "3.0.0-alpha.4"}, {"status": "unaffected", "version": "4bf35cf9e45573a5f55a6f52995086c1da89c096", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.0", "versionEndExcluding": "2.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:3.0:alpha1:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:3.0:alpha2:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:3.0:alpha3:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:3.0:alpha4:*:*:*:*:*:*"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "references": [{"url": "https://github.com/SimpleMachines/SMF/commit/4bf35cf9e45573a5f55a6f52995086c1da89c096", "name": "Patch Commit (v3.0)", "tags": ["patch"]}, {"url": "https://github.com/SimpleMachines/SMF/commit/b4d23dfd74a511587c605f9d294cefc3a75b4b26", "name": "Patch Commit (v2.1)", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/simple-machines-forum-ssrf-via-image-proxy", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Hamed Kohi", "type": "finder"}, {"lang": "en", "value": "VulnCheck", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T13:20:14.309005Z", "id": "CVE-2026-61520", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T13:26:47.794Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T13:20:14.309005Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T13:20:15.312Z"}}], "cna": {"tags": ["x_open-source"], "title": "Simple Machines Forum SSRF via image proxy", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Hamed Kohi"}, {"lang": "en", "type": "finder", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/SimpleMachines/SMF", "vendor": "SimpleMachines", "product": "SMF", "versions": [{"status": "affected", "version": "2.1.0", "lessThan": "2.1.8", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.8", "versionType": "semver"}, {"status": "unaffected", "version": "b4d23dfd74a511587c605f9d294cefc3a75b4b26", "versionType": "git"}, {"status": "affected", "version": "3.0.0-alpha.1", "versionType": "semver", "lessThanOrEqual": "3.0.0-alpha.4"}, {"status": "unaffected", "version": "4bf35cf9e45573a5f55a6f52995086c1da89c096", "versionType": "git"}], "packageURL": "pkg:github/SimpleMachines/SMF", "defaultStatus": "unaffected"}], "datePublic": "2026-07-14T00:00:00.000Z", "references": [{"url": "https://github.com/SimpleMachines/SMF/commit/4bf35cf9e45573a5f55a6f52995086c1da89c096", "name": "Patch Commit (v3.0)", "tags": ["patch"]}, {"url": "https://github.com/SimpleMachines/SMF/commit/b4d23dfd74a511587c605f9d294cefc3a75b4b26", "name": "Patch Commit (v2.1)", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/simple-machines-forum-ssrf-via-image-proxy", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.8", "versionStartIncluding": "2.1.0"}, {"criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:3.0:alpha1:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:3.0:alpha2:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:3.0:alpha3:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:simplemachines:simple_machines_forum:3.0:alpha4:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:16:07.731Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61520", "state": "PUBLISHED", "dateUpdated": "2026-10-29T21:16:07.731Z", "dateReserved": "2026-07-10T15:43:36.628Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-14T20:17:15.901Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/SimpleMachines/SMF", "product": "SMF", "repo": "https://github.com/SimpleMachines/SMF", "vendor": "SimpleMachines", "versions": [{"lessThan": "2.1.8", "status": "affected", "version": "2.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.8", "versionType": "semver"}, {"status": "unaffected", "version": "b4d23dfd74a511587c605f9d294cefc3a75b4b26", "versionType": "git"}, {"lessThanOrEqual": "3.0.0-alpha.4", "status": "affected", "version": "3.0.0-alpha.1", "versionType": "semver"}, {"status": "unaffected", "version": "4bf35cf9e45573a5f55a6f52995086c1da89c096", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services."}, {"lang": "es", "value": "Simple Machines Forum 2.1 anterior al commit 4bf35cf y 3.0 anterior al commit b4d23df contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor en el proxy de im\u00e1genes que permite a atacantes autenticados activar peticiones HTTP internas incrustando URLs controladas por el atacante en etiquetas de imagen BBCode, las cuales el proxy obtiene sin validar las IPs de destino resueltas contra rangos de direcciones privadas, loopback o direcciones link-local. Los atacantes pueden aprovechar la generaci\u00f3n autom\u00e1tica de firmas HMAC de SMF para cualquier URL de imagen incrustada para obtener peticiones de proxy firmadas v\u00e1lidas dirigidas a servicios internos como puntos finales de metadatos de instancias en la nube, aplicaciones web internas y servicios de red de contenedores."}], "id": "CVE-2026-61520", "lastModified": "2026-10-29T21:17:27.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61520", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T13:20:14.309005Z", "version": "2.0.3"}}]}, "published": "2026-07-14T21:17:06.290", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/SimpleMachines/SMF/commit/4bf35cf9e45573a5f55a6f52995086c1da89c096"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/SimpleMachines/SMF/commit/b4d23dfd74a511587c605f9d294cefc3a75b4b26"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/simple-machines-forum-ssrf-via-image-proxy"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.0,2.1.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b4d23dfd74a511587c605f9d294cefc3a75b4b26"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "4bf35cf9e45573a5f55a6f52995086c1da89c096"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.0.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "SMF", "source": "cna", "vendor": "SimpleMachines"}, "product": "smf", "vendor": "simplemachines"}], "created": "2026-07-15T14:45:03.224264+00:00", "updated": "2026-10-30T00:15:04.571141+00:00", "vendors": ["simplemachines", "simplemachines$PRODUCT$smf"]}