Most recent entries from all

EUVD-2026-339408

2026-10-05T19:51:39.343056+00:00

EUVD-2026-339408

fkie_cve-2026-46556

2026-10-05T19:51:39.343094+00:00

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. Version 2.2.1 patches the issue.

GHSA-xq32-9g7q-7297 — FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

2026-10-05T19:51:39.343129+00:00

Affected: PyPI: flaskbb

###Summary A Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services (e.g., AWS 169.254.169.254). This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. CVSS 6.5 Medium.

###Details In flaskbb/utils/helpers.py (line 571), the url parameter is passed directly to requests.get(url, stream=True) without any validation of scheme, host, or IP address. ``` python# flaskbb/utils/helpers.py:571 def get_image_info(url: str): r = requests.get(url, timeout=(3.05, 27), stream=True) ```

Attack chain:

``` POST /user/settings/user-details (avatar URL) → ValidateAvatarURL.validate() # validators.py:103 → check_image(avatar) # helpers.py:628 → get_image_info(url) # helpers.py:571 → requests.get(url) # No domain/IP restriction Entry points:

/user/settings/user-details (any authenticated user) /admin/users//edit (admin only)

```

###PoC [submit.zip](https://github.com/user-attachments/files/26301527/submit.zip)

Log in to FlaskBB as any user Navigate to Settings → User Details Enter http://169.254.169.254/latest/meta-data/ as the avatar URL Submit the form The server sends a GET request to the internal metadata endpoint

Three exploitation channels confirmed:

Server-side request: Captured on mock metadata server Internal port scan: check_image() r…

PYSEC-2026-2479 — FlaskBB: SSRF in get_image_info() via unrestricted avatar URL