Server-side Request Forgery in Blombooru Personal Booru

CVE-2026-57448

What is CVE-2026-57448?

The Blombooru application, a self-hosted digital image organization tool, contains a vulnerability in the administrator-only GET /proxy-image API endpoint. Prior to version 1.40.0, this endpoint incorrectly processes the url query parameter without adequate validation of its destination. This flaw permits an authenticated administrator to inadvertently target internal services and access sensitive cloud instance metadata, including credentials associated with Identity and Access Management (IAM). The issue allows for exploitation through unrestricted access to private, loopback, and link-local addresses. Affected users should upgrade to version 1.40.0 to mitigate these security risks.

References