CVE-2026-61520: Simple Machines Forum SSRF Vulnerability

CVE-2026-61520 Overview

CVE-2026-61520 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Simple Machines Forum (SMF). The flaw affects SMF 2.1 prior to commit 4bf35cf and SMF 3.0 prior to commit b4d23df. The vulnerability resides in the image proxy component, which fetches attacker-controlled URLs embedded in BBCode image tags without validating resolved destination IP addresses. Authenticated attackers can abuse SMF's automatic HMAC signature generation to obtain valid signed proxy requests targeting internal services. Attack targets include cloud instance metadata endpoints, internal web applications, and container network services.

Critical Impact
Authenticated attackers can pivot through the SMF image proxy to reach internal-only services, exposing cloud metadata credentials, private applications, and container networks.

Affected Products

Simple Machines Forum 2.1 prior to commit 4bf35cf9e45573a5f55a6f52995086c1da89c096
Simple Machines Forum 3.0 prior to commit b4d23dfd74a511587c605f9d294cefc3a75b4b26
Deployments exposing the SMF image proxy endpoint (ProxyServer.php)

Discovery Timeline

2026-07-14 - CVE-2026-61520 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61520

Vulnerability Analysis

The SMF image proxy is designed to fetch and re-serve remote images embedded via BBCode. Before the patch, the proxy only rejected requests where the host was a literal IP address or the string localhost. This host-string check did not resolve the target hostname, allowing an attacker to supply an attacker-controlled domain that resolves to a private, loopback, or link-local address. SMF automatically generates an HMAC signature for any embedded image URL, so the attacker receives a valid signed proxy request that the server will fetch. The proxy then dispatches an outbound HTTP request from the SMF host to the internal destination.

Root Cause

The root cause is missing IP-based validation of the resolved destination after DNS lookup. The vulnerable code in Sources/ProxyServer.php performed only filter_var($request->host, FILTER_VALIDATE_IP) and a localhost string comparison. It did not verify whether a hostname resolved to RFC 1918 private ranges, 127.0.0.0/8 loopback, or 169.254.0.0/16 link-local addresses used by cloud instance metadata services such as 169.254.169.254. Redirects were similarly unchecked, so an initial safe fetch could be redirected to an internal target.

Attack Vector

An authenticated forum user embeds a BBCode image tag pointing at an attacker-controlled URL. SMF signs the URL with its HMAC key and rewrites it through the proxy endpoint. When the proxy processes the request, it resolves the hostname and issues an HTTP request to whatever address DNS returns. The attacker can point DNS at internal addresses directly or use a 302 redirect to internal endpoints. Response content and error signals may be reflected back to the attacker through cached proxy responses.

php

// Patched validation in Sources/ProxyServer.php
$request = new Url($_GET['request']);

if (
    // Basic sanity check.
    !$request->isValid()
    // Don't proxy our own resources.
    || $request->host === Url::create(Config::$boardurl)->host
    // SSRF protection: don't proxy localhost, private or reserved IPs, etc.
    || !WebFetchApi::isFetchSafe($request)
) {
    return false;
}

Source: SMF commit 4bf35cf

Detection Methods for CVE-2026-61520

Indicators of Compromise

Requests to the SMF proxy endpoint (?action=proxy or proxy.php) containing HMAC-signed URLs that resolve to RFC 1918, 127.0.0.0/8, or 169.254.0.0/16 addresses.
Outbound connections from the SMF web server to 169.254.169.254, metadata.google.internal, or internal service ports (Redis, Elasticsearch, Kubernetes API).
Web server logs showing repeated proxy fetches to attacker-controlled hostnames returning 302 redirects.
BBCode [img] tags in posts or private messages containing URLs to unusual or newly registered domains.

Detection Strategies

Inspect HTTP access logs for the SMF proxy handler and correlate the decoded request parameter against internal IP ranges.
Alert on any egress traffic from the SMF host destined for cloud metadata addresses or private CIDR blocks.
Query the forum database for BBCode image URLs matching link-local, private, or metadata service patterns.

Monitoring Recommendations

Enable egress filtering logs on the SMF server and forward them to a centralized SIEM for correlation.
Monitor for anomalous DNS lookups from the SMF process resolving to private address space.
Track outbound connection counts per destination IP to detect scanning activity through the proxy.

How to Mitigate CVE-2026-61520

Immediate Actions Required

Apply commit 4bf35cf for SMF 2.1 or commit b4d23df for SMF 3.0 without delay.
Restrict outbound network access from the SMF web server to only required external destinations.
Block access from the SMF host to cloud instance metadata endpoints such as 169.254.169.254.
Rotate any cloud IAM credentials that were reachable from the SMF host via metadata service.

Patch Information

The fix introduces WebFetchApi::isFetchSafe() validation in Sources/ProxyServer.php and re-validates redirect targets in Sources/Class-CurlFetchWeb.php. Patched commits are 4bf35cf for SMF 2.1 and b4d23df for SMF 3.0. Full technical details are available in the VulnCheck Security Advisory.

Workarounds

Disable the image proxy feature in SMF configuration until patching is complete.
Deploy IMDSv2 with hop-limit enforcement on AWS instances hosting SMF to blunt metadata theft.
Enforce egress firewall rules that deny traffic from the SMF host to private, loopback, and link-local ranges.

bash

# Example iptables egress rules blocking SSRF targets from the SMF host
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j REJECT