CVE-2026-61520 is an SSRF vulnerability affecting Simple Machines Forum (SMF) versions before commit 4bf35cf in 2.1 and before commit b4d23df in 3.0. The vulnerability exists in the image proxy component, which fetches images referenced in BBCode tags. The proxy does not validate whether the resolved IP addresses belong to private, loopback, or link-local ranges, enabling attackers with authentication to craft URLs that cause the proxy to send requests to internal network services. Additionally, SMF's automatic HMAC signature generation for image URLs can be abused to generate valid signed requests, facilitating exploitation of internal endpoints such as cloud instance metadata services and container network services.

An authenticated attacker can exploit this vulnerability to perform SSRF attacks, potentially accessing sensitive internal services that are not exposed externally. This could lead to information disclosure or further internal network compromise depending on the targeted internal services. The CVSS 4.0 base score is 6.3, indicating a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to trusted users only and monitor for suspicious use of BBCode image tags. Avoid exposing sensitive internal services that could be targeted via SSRF. Follow vendor advisories for updates on patches or official mitigations.