CVE-2026-46556CWE-918

FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

Medium · published July 21, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. Version 2.2.1 patches the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-21T20:34Z
EPSS history
Timeline
  • 21 JUL 20:34Z
    FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
    cvelistv5