Read the docs
TI-2026-44093 Aliases CVE-2026-61520GHSA-9wvj-rhhh-8292

Simple Machines Forum SSRF via image proxy

Priority LOW 28CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Fix Fixed SMF (SimpleMachines): 2.1.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SimpleMachinesSMF2.1.0 to before 2.1.8; 3.0.0-alpha.1 – 3.0.0-alpha.42.1.8Patch availableCNA
  • SMF VendorSimpleMachines Affected 2.1.0 to before 2.1.8; 3.0.0-alpha.1 – 3.0.0-alpha.4 Fixed in 2.1.8 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:simplemachines:simple_machines_forum:*:*:*:*:*:*:*:*——SimpleMachines
  • cpe:2.3:a:simplemachines:simple_machines_forum:*:*:*:*:*:*:*:* Versions — — ·SimpleMachines

Remediation

  • Fix · CNA SMF (SimpleMachines) Fixed in 2.1.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61520
  2. 2026-10-03 Alias added: GHSA-9wvj-rhhh-8292
  3. 2026-10-29 Fix available: SimpleMachines/[email protected], SimpleMachines/SMF@b4d23dfd74a511587c605f9d294cefc3a75b4b26 · CNA

References

Patch 2

  • TI-2025-41147 A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows… CVSS 3.1MEDIUM 6.1
  • TI-2024-06892 SimpleMachines SMF User Alert Read Status index.php resource injection CVSS 4.0MEDIUM 5.3
  • TI-2024-06891 SimpleMachines SMF Delete User index.php resource injection CVSS 4.0MEDIUM 5.3
  • TI-2025-02251 SimpleMachines SMF ManageNews.php cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2025-02250 SimpleMachines SMF ManageAttachments.php cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2011-00980 SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not… CVSS 2.0HIGH 10.0
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences