Answer in brief
CVE-2026-61520 records a Medium severity (CVSS 6.3) vulnerability in Simple Machines Forum SSRF via image proxy. The current sources do not mark it as known exploited. The current feed maps SimpleMachines/SMF (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps SimpleMachines/SMF (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| SimpleMachines/SMFgeneric | >=2.1.0 <2.1.8 || >=3.0.0-alpha.1 <=3.0.0-alpha.4 | 2.1.8 |
Published upstream
Jul 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 15, 2026
Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services.
Quoted source text, attributed separately from HOL analysis.