Simple Machines Forum CVE-2026-61520

Exploitation requires a low-privilege authenticated SMF session - any registered forum member account is sufficient per CVSS PR:L. The SMF image proxy feature must be active (it is an optional but commonly enabled feature configurable in forum administration settings). The highest-impact exploitation path - cloud credential theft via IMDS - additionally requires the SMF server to be hosted in a cloud environment (AWS, GCP, Azure, DigitalOcean, etc.) where the Instance Metadata Service is reachable at 169.254.169.254 from the application host; on-premises deployments without internal HTTP services accessible from the SMF host face substantially reduced impact. Exploitation is constrained by: the mandatory authenticated session requirement (eliminates unauthenticated remote attackers); the need for image proxy to be enabled; the indirect response channel (the SSRF response is delivered out-of-band rather than reflected directly to the attacker in the HTTP response, requiring DNS/HTTP callback infrastructure); and SSVC Automatable:no, indicating mass automated exploitation is not straightforward. Open registration forums are more exposed than invite-only or closed communities.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H) scores 6.3, reflecting network-accessible low-complexity exploitation requiring only a low-privilege account, with no direct impact on the SMF host but high confidentiality impact on subsequent internal systems. The EPSS score of 0.25% (16th percentile) and SSVC classification of Exploitation:none, Automatable:no, Technical Impact:partial collectively indicate no observed active exploitation and limited automation potential - likely because obtaining authenticated sessions at scale adds friction. Real-world risk is strongly environment-dependent: SMF instances hosted in AWS, GCP, Azure, or DigitalOcean face meaningful exposure to IMDS credential theft (which can yield cloud IAM tokens enabling lateral movement), whereas isolated on-premises deployments face lower residual risk from internal service probing. The SC:H metric is consistent with the cloud metadata scenario, where a single SSRF request can return credentials authorizing actions far beyond the SMF application boundary. No CVSS 3.1 vector was supplied in the input data - the 3.1 assessment in this report is independently derived. SSVC's Automatable:no reduces urgency compared to a PR:N finding, but the low authentication bar (any registered user) means the effective exposure surface is the entire forum membership.

An authenticated SMF forum member with any level of membership registers a domain (e.g., metadata.attacker.example) with a DNS A record pointing to 169.254.169.254, then creates a forum post containing a BBCode image tag referencing that domain. When SMF processes the post, the image proxy resolves the hostname, generates a valid HMAC-signed fetch request, and retrieves the AWS or GCP instance metadata endpoint from the server itself, returning cloud IAM credentials or instance identity documents. The attacker observes the fetched content via an out-of-band HTTP listener or by examining DNS query logs to confirm the server resolved the name, then uses returned credentials to authenticate to cloud APIs and pivot beyond the SMF host.