Blombooru
Monthly
Blombooru releases before 1.40.0 expose an administrator-only image proxy at GET /api/booru-import/proxy-image that fetches any caller-supplied URL server-side with only a check that the value starts with 'http', so private, loopback and link-local destinations are reachable through the application. An authenticated administrator (CVSS PR:H) can therefore enumerate internal services, hang the worker with a recursive self-request, or reach a cloud metadata endpoint such as 169.254.169.254 to harvest IAM credentials - so the confidentiality impact lands primarily on the surrounding cloud or network boundary rather than on Blombooru itself, and only on deployments that expose such services. No CISA KEV entry is recorded, though the vendor advisory includes reproduction steps demonstrating a request reaching an internal Redis port and a recursive self-request; this is a this-month patching priority, not an emergency, because the admin-authentication prerequisite keeps the endpoint out of reach of anonymous attackers.
Blombooru releases before 1.40.0 expose an administrator-only image proxy at GET /api/booru-import/proxy-image that fetches any caller-supplied URL server-side with only a check that the value starts with 'http', so private, loopback and link-local destinations are reachable through the application. An authenticated administrator (CVSS PR:H) can therefore enumerate internal services, hang the worker with a recursive self-request, or reach a cloud metadata endpoint such as 169.254.169.254 to harvest IAM credentials - so the confidentiality impact lands primarily on the surrounding cloud or network boundary rather than on Blombooru itself, and only on deployments that expose such services. No CISA KEV entry is recorded, though the vendor advisory includes reproduction steps demonstrating a request reaching an internal Redis port and a recursive self-request; this is a this-month patching priority, not an emergency, because the admin-authentication prerequisite keeps the endpoint out of reach of anonymous attackers.