Forocoches Comments Editor
Monthly
The Forocoches comments editor allows any user holding a forum account with commenting privileges to embed an image whose source URL points at a server they control; when other users later open the affected discussion thread, their browsers automatically issue the HTTP/HTTPS request to that external host, disclosing the viewer's source IP address, User-Agent string, access timestamp and related request metadata to the attacker. The exposure is limited to that request metadata - no post content, credentials or session data is described as leaking - and it only occurs once a victim actually renders the thread, with no ability for the attacker to choose which users are hit. Affected builds are those prior to the May 2026 revision; no public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor notice is published by INCIBE (EUVD-2026-113760).
The Forocoches comments editor allows any user holding a forum account with commenting privileges to embed an image whose source URL points at a server they control; when other users later open the affected discussion thread, their browsers automatically issue the HTTP/HTTPS request to that external host, disclosing the viewer's source IP address, User-Agent string, access timestamp and related request metadata to the attacker. The exposure is limited to that request metadata - no post content, credentials or session data is described as leaking - and it only occurs once a victim actually renders the thread, with no ability for the attacker to choose which users are hit. Affected builds are those prior to the May 2026 revision; no public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor notice is published by INCIBE (EUVD-2026-113760).