Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57448— Blombooru: administrator image-proxy server-side request forgery

Quick assessment

Affected
mrblomblo blombooru
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Blombooru 是一个自托管的个人图库（booru），用于整理和标记私人图片收藏。在 1.40.0 版本之前，仅限管理员访问的 端点（暴露为 ）会接受一个名为 的查询参数，并在服务器端直接获取该链接，而缺乏对目标地址的有效验证。 在 中的 函数仅检查参数值是否以 开头，随后通过 或 获取并流式传输响应。该函数未阻止私有地址、回环地址（loopback）以及链路本地地址（link-local）。此外，自动跟随的重定向可能将请求从受信任的域引导至内部地址。 已认证的管理员可利用此漏洞枚举内部服务并访问云实例元数据，

CVSS 6.2 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57448

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Blombooru: administrator image-proxy server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `/api/booru-import/proxy-image`, accepts a `url` query parameter and fetches it server-side without meaningful destination validation. `proxy_image()` in `backend/app/routes/booru_import.py` only checks whether the value starts with http, then uses `get_client_for_url` or `requests.get` and streams the response. Private, loopback and link-local addresses are not blocked, and automatically followed redirects can move a request from a trusted domain to an internal address. An authenticated administrator can enumerate internal services and access cloud instance metadata, potentially disclosing IAM credentials and crossing the application's intended cloud or network trust boundary. The reporter also observed a hanging recursive self-request. Administrator authentication remains a prerequisite; this is not an anonymous proxy. This issue is fixed in version 1.40.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mrblomblo blombooru < 1.40.0 -

II. Public POCs for CVE-2026-57448

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57448

请登录查看更多情报信息。

Other References for CVE-2026-57448 (3)

IV. Related Vulnerabilities

Same weakness: CWE-918