Blombooru EUVD-2026-112506

Exploitation requires an authenticated administrator session because the vulnerable GET /api/booru-import/proxy-image endpoint is administrator-only (CVSS PR:H) - this is explicitly not an anonymous proxy. The concrete trigger is the attacker-controlled url query parameter, which proxy_image() in backend/app/routes/booru_import.py passes to get_client_for_url or requests.get after only checking that the value starts with 'http', with no blocking of private, loopback, or link-local ranges. Two factors make impact deployment-dependent: the high-value credential-theft outcome applies specifically to cloud deployments (AWS/GCP/Azure) that expose an instance metadata service at 169.254.169.254, and because requests.get follows redirects by default (pre-patch), an open redirect on a trusted domain can chain to an internal address. The principal limiting factor is the admin-authentication requirement; absent credential theft or a malicious/compromised admin, the endpoint is not externally reachable by an unauthenticated attacker.

This is a genuine but conditional server-side request forgery (CWE-918) that should be treated as a this-month patching priority rather than an emergency, matching the input's 'this_month' decision label. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 6.2 Medium) is internally consistent with the description: network-reachable, low complexity, but requiring high privileges (PR:H) because the vulnerable endpoint is administrator-only. The most notable signal is the scope/subsequent-system impact - VC:L on the vulnerable app itself but SC:H on subsequent systems - which correctly reflects that the real danger is not the booru server but what the SSRF can reach (cloud instance metadata and internal services), potentially disclosing IAM credentials. No EPSS score and no KEV status are provided in the input, so there is no evidence of active exploitation or a quantified exploitation probability; this is not in CISA KEV. A detailed, author-tested proof of concept is published in the GHSA advisory, so exploitability is well established even though no independent weaponized exploit is confirmed. The practical risk ceiling is high (cloud account compromise) but gated by the PR:H prerequisite - an attacker must already hold or steal administrator authentication, so this is primarily a privilege-escalation / trust-boundary-crossing issue for compromised or malicious admins, not a mass-exploitable anonymous vector.

An authenticated administrator (or an attacker who has phished, session-hijacked, or credential-stuffed an admin account) sends GET /api/booru-import/proxy-image?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ and the server fetches the cloud metadata endpoint and streams back IAM credentials, enabling escalation to the broader cloud account. A tested public PoC in the GHSA advisory also demonstrates internal port enumeration (Redis 6379, PostgreSQL 5432) and a hanging recursive self-request against port 8000. Given AV:N/AC:L, the requests are trivial once admin access is held.