CVE-2026-46556: FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

May 21, 2026

A Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services (e.g., AWS 169.254.169.254). This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. CVSS 6.5 Medium.

References

github.com/advisories/GHSA-xq32-9g7q-7297
github.com/flaskbb/flaskbb/security/advisories/GHSA-xq32-9g7q-7297
nvd.nist.gov/vuln/detail/CVE-2026-46556

Code Behaviors & Features

Detect and mitigate CVE-2026-46556 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →