Threats affecting pkg:github/mrblomblo/blombooru

CVE-2026-57448 is a server-side request forgery (SSRF) vulnerability in the mrblomblo blombooru application prior to version 1.40.0. The vulnerability exists in the administrator-only GET /proxy-image endpoint, which fetches URLs server-side without proper validation. This allows an authenticated administrator to access internal network services and cloud instance metadata, potentially exposing sensitive credentials. The issue is fixed in version 1.40.0.