CVE-2026-61520

Name of the Vulnerable Software and Affected Versions Simple Machines Forum versions 2.1 prior to commit 4bf35cf Simple Machines Forum versions 3.0 prior to commit b4d23df

Description The image proxy allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags. The proxy fetches these URLs without validating resolved destination IPs against loopback, link-local, or private address ranges. Attackers can use the automatic HMAC (Hash-based Message Authentication Code) signature generation to create valid signed proxy requests targeting internal services, including container network services, internal web applications, and cloud instance metadata endpoints.

Recommendations Update Simple Machines Forum version 2.1 to commit 4bf35cf or later. Update Simple Machines Forum version 3.0 to commit b4d23df or later.