FlaskBB
A classic Forum Software in Python using Flask.
View on Github
Activity
- Latest release
- 6mo ago
- Total releases
- 5
- Cadence
- ~3 months
- Last 12 months
- 1
Reach
- Stars
- —
Details
- License
- BSD-3-Clause
- First release
- Jan 12, 2018
| Version | Released | |
|---|---|---|
2.2.0
minor
1 CVE
CVE-2026-46556
PYSEC-2026-2479
GHSA-xq32-9g7q-7297
Jul 13, 2026
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
###Summary A Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services (e.g., AWS 169.254.169.254). This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. CVSS 6.5 Medium. ###Details In flaskbb/utils/helpers.py (line 571), the url parameter is passed directly to requests.get(url, stream=True) without any validation of scheme, host, or IP address. Attack chain: ###PoC submit.zip Log in to FlaskBB as any user Navigate to Settings → User Details Enter http://169.254.169.254/latest/meta-data/ as the avatar URL Submit the form The server sends a GET request to the internal metadata endpoint Three exploitation channels confirmed: Server-side request: Captured on mock metadata server Internal port scan: check_image() returns distinct errors (CONN_REFUSED, NO_CONTENT_LENGTH, TYPE_NOT_ALLOWED, SUCCESS) that map internal network topology Internal API triggering: Mock APIs on 127.0.0.1:9200 triggered via SSRF (deploy, shutdown, key dump endpoints) ###Impact Any authenticated user is impacted. Attackers can force the server to request internal services, cloud metadata endpoints, or private network resources. On cloud deployments (AWS/GCP/Azure), IAM credentials can be leaked. In production, any GET-triggered internal service is reachable: CI/CD webhooks, Elasticsearch, etcd, Consul, etc. Affected versions
2.0.0
2.0.0.dev0
2.0.1
2.0.2
2.2.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.0.2
patch
1 CVE
CVE-2026-46556
PYSEC-2026-2479
GHSA-xq32-9g7q-7297
Jul 13, 2026
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
###Summary A Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services (e.g., AWS 169.254.169.254). This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. CVSS 6.5 Medium. ###Details In flaskbb/utils/helpers.py (line 571), the url parameter is passed directly to requests.get(url, stream=True) without any validation of scheme, host, or IP address. Attack chain: ###PoC submit.zip Log in to FlaskBB as any user Navigate to Settings → User Details Enter http://169.254.169.254/latest/meta-data/ as the avatar URL Submit the form The server sends a GET request to the internal metadata endpoint Three exploitation channels confirmed: Server-side request: Captured on mock metadata server Internal port scan: check_image() returns distinct errors (CONN_REFUSED, NO_CONTENT_LENGTH, TYPE_NOT_ALLOWED, SUCCESS) that map internal network topology Internal API triggering: Mock APIs on 127.0.0.1:9200 triggered via SSRF (deploy, shutdown, key dump endpoints) ###Impact Any authenticated user is impacted. Attackers can force the server to request internal services, cloud metadata endpoints, or private network resources. On cloud deployments (AWS/GCP/Azure), IAM credentials can be leaked. In production, any GET-triggered internal service is reachable: CI/CD webhooks, Elasticsearch, etcd, Consul, etc. Affected versions
2.0.0
2.0.0.dev0
2.0.1
2.0.2
2.2.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.0.1
patch
1 CVE
CVE-2026-46556
PYSEC-2026-2479
GHSA-xq32-9g7q-7297
Jul 13, 2026
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
###Summary A Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services (e.g., AWS 169.254.169.254). This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. CVSS 6.5 Medium. ###Details In flaskbb/utils/helpers.py (line 571), the url parameter is passed directly to requests.get(url, stream=True) without any validation of scheme, host, or IP address. Attack chain: ###PoC submit.zip Log in to FlaskBB as any user Navigate to Settings → User Details Enter http://169.254.169.254/latest/meta-data/ as the avatar URL Submit the form The server sends a GET request to the internal metadata endpoint Three exploitation channels confirmed: Server-side request: Captured on mock metadata server Internal port scan: check_image() returns distinct errors (CONN_REFUSED, NO_CONTENT_LENGTH, TYPE_NOT_ALLOWED, SUCCESS) that map internal network topology Internal API triggering: Mock APIs on 127.0.0.1:9200 triggered via SSRF (deploy, shutdown, key dump endpoints) ###Impact Any authenticated user is impacted. Attackers can force the server to request internal services, cloud metadata endpoints, or private network resources. On cloud deployments (AWS/GCP/Azure), IAM credentials can be leaked. In production, any GET-triggered internal service is reachable: CI/CD webhooks, Elasticsearch, etcd, Consul, etc. Affected versions
2.0.0
2.0.0.dev0
2.0.1
2.0.2
2.2.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.0.0
initial
1 CVE
CVE-2026-46556
PYSEC-2026-2479
GHSA-xq32-9g7q-7297
Jul 13, 2026
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
###Summary A Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services (e.g., AWS 169.254.169.254). This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. CVSS 6.5 Medium. ###Details In flaskbb/utils/helpers.py (line 571), the url parameter is passed directly to requests.get(url, stream=True) without any validation of scheme, host, or IP address. Attack chain: ###PoC submit.zip Log in to FlaskBB as any user Navigate to Settings → User Details Enter http://169.254.169.254/latest/meta-data/ as the avatar URL Submit the form The server sends a GET request to the internal metadata endpoint Three exploitation channels confirmed: Server-side request: Captured on mock metadata server Internal port scan: check_image() returns distinct errors (CONN_REFUSED, NO_CONTENT_LENGTH, TYPE_NOT_ALLOWED, SUCCESS) that map internal network topology Internal API triggering: Mock APIs on 127.0.0.1:9200 triggered via SSRF (deploy, shutdown, key dump endpoints) ###Impact Any authenticated user is impacted. Attackers can force the server to request internal services, cloud metadata endpoints, or private network resources. On cloud deployments (AWS/GCP/Azure), IAM credentials can be leaked. In production, any GET-triggered internal service is reachable: CI/CD webhooks, Elasticsearch, etcd, Consul, etc. Affected versions
2.0.0
2.0.0.dev0
2.0.1
2.0.2
2.2.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.0.0.dev0
pre
1 CVE
CVE-2026-46556
PYSEC-2026-2479
GHSA-xq32-9g7q-7297
Jul 13, 2026
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
###Summary A Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services (e.g., AWS 169.254.169.254). This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. CVSS 6.5 Medium. ###Details In flaskbb/utils/helpers.py (line 571), the url parameter is passed directly to requests.get(url, stream=True) without any validation of scheme, host, or IP address. Attack chain: ###PoC submit.zip Log in to FlaskBB as any user Navigate to Settings → User Details Enter http://169.254.169.254/latest/meta-data/ as the avatar URL Submit the form The server sends a GET request to the internal metadata endpoint Three exploitation channels confirmed: Server-side request: Captured on mock metadata server Internal port scan: check_image() returns distinct errors (CONN_REFUSED, NO_CONTENT_LENGTH, TYPE_NOT_ALLOWED, SUCCESS) that map internal network topology Internal API triggering: Mock APIs on 127.0.0.1:9200 triggered via SSRF (deploy, shutdown, key dump endpoints) ###Impact Any authenticated user is impacted. Attackers can force the server to request internal services, cloud metadata endpoints, or private network resources. On cloud deployments (AWS/GCP/Azure), IAM credentials can be leaked. In production, any GET-triggered internal service is reachable: CI/CD webhooks, Elasticsearch, etcd, Consul, etc. Affected versions
2.0.0
2.0.0.dev0
2.0.1
2.0.2
2.2.0
References Updated Jul 13, 2026 · Source: OSV.dev |