CVE-2026-61520

{
  "id": "CVE-2026-61520",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T21:17:06.290",
  "lastModified": "2026-10-29T21:17:27.057",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services."
    },
    {
      "lang": "es",
      "value": "Simple Machines Forum 2.1 anterior al commit 4bf35cf y 3.0 anterior al commit b4d23df contiene una vulnerabilidad de falsificación de petición del lado del servidor en el proxy de imágenes que permite a atacantes autenticados activar peticiones HTTP internas incrustando URLs controladas por el atacante en etiquetas de imagen BBCode, las cuales el proxy obtiene sin validar las IPs de destino resueltas contra rangos de direcciones privadas, loopback o direcciones link-local. Los atacantes pueden aprovechar la generación automática de firmas HMAC de SMF para cualquier URL de imagen incrustada para obtener peticiones de proxy firmadas válidas dirigidas a servicios internos como puntos finales de metadatos de instancias en la nube, aplicaciones web internas y servicios de red de contenedores."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SimpleMachines",
          "product": "SMF",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/SimpleMachines/SMF",
          "packageURL": "pkg:github/SimpleMachines/SMF",
          "versions": [
            {
              "version": "2.1.0",
              "lessThan": "2.1.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.1.8",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "b4d23dfd74a511587c605f9d294cefc3a75b4b26",
              "versionType": "git",
              "status": "unaffected"
            },
            {
              "version": "3.0.0-alpha.1",
              "lessThanOrEqual": "3.0.0-alpha.4",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4bf35cf9e45573a5f55a6f52995086c1da89c096",
              "versionType": "git",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T13:20:14.309005Z",
          "id": "CVE-2026-61520",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/SimpleMachines/SMF/commit/4bf35cf9e45573a5f55a6f52995086c1da89c096",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/SimpleMachines/SMF/commit/b4d23dfd74a511587c605f9d294cefc3a75b4b26",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/simple-machines-forum-ssrf-via-image-proxy",
      "source": "[email protected]"
    }
  ]
}