CVE-2026-46556 Details
Description
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. Version 2.2.1 patches the issue.
A server-side request forgery (SSRF) vulnerability has been identified in FlaskBB versions through 2.2.0. The issue arises in the 'get_image_info()' function, where the avatar URL provided by users is sent to internal endpoints without proper validation. This blind SSRF allows authenticated users to access arbitrary internal services, including cloud metadata APIs, and has been confirmed to enable internal port scanning and triggering of local APIs. The vulnerability could lead to unauthorized access to sensitive information, such as IAM credentials on cloud platforms.
Users can update to FlaskBB version 2.2.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flaskbb/flaskbb/security/advisories/GHSA-xq32-9g7q-7297 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/flaskbb/flaskbb/commit/e87e585f54bbe36694e91d52ee9b2d2e65dd4ab5 | [email protected] | Source CodeVendor |
| https://github.com/flaskbb/flaskbb/security/advisories/GHSA-xq32-9g7q-7297 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FlaskBB | <= 2.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |