CVE-2026-61520 is a server-side request forgery vulnerability affecting Simple Machines Forum (SMF) versions 2.1.0 up to but not including 2.1.7. The flaw exists in the image proxy component, which fetches images from URLs embedded in BBCode image tags. The proxy does not validate whether the resolved IP addresses belong to private, loopback, or link-local ranges, allowing attackers with authentication to cause the server to make HTTP requests to internal services. Additionally, SMF automatically generates HMAC signatures for these image URLs, enabling attackers to obtain valid signed requests that can bypass typical protections and target internal endpoints such as cloud metadata services or container network services.

An authenticated attacker can exploit this vulnerability to make the SMF server send HTTP requests to internal network services that are normally inaccessible externally. This can lead to unauthorized access to sensitive internal resources, including cloud instance metadata endpoints and internal web applications. The vulnerability does not require user interaction beyond authentication and does not involve privilege escalation or remote code execution, but it can facilitate information disclosure or internal network reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released, restrict or monitor authenticated users' ability to embed external image URLs in BBCode or disable the image proxy feature if feasible. Review internal network segmentation and access controls to limit the impact of SSRF attacks. Follow vendor communications for updates on patches or official mitigations.