https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 22:13:53 +0000 https://db.gcve.eu/vuln/cve-2026-57448 <p><strong>Affected:</strong> mrblomblo blombooru</p> <p>Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `/api/booru-import/proxy-image`, accepts a `url` query parameter and fetches it server-side without meaningful destination validation. `proxy_image()` in `backend/app/routes/booru_import.py` only checks whether the value starts with http, then uses `get_client_for_url` or `requests.get` and streams the response. Private, loopback and link-local addresses are not blocked, and automatically followed redirects can move a request from a trusted domain to an internal address. An authenticated administrator can enumerate internal services and access cloud instance metadata, potentially disclosing IAM credentials and crossing the application&#39;s intended cloud or network trust boundary. The reporter also observed a hanging recursive self-request. Administrator authentication remains a prerequisite; this is not an anonymous proxy. This issue is fixed in version 1.40.0.</p> <p><strong>Affected:</strong> mrblomblo blombooru</p> <p>Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `/api/booru-import/proxy-image`, accepts a `url` query parameter and fetches it server-side without meaningful destination validation. `proxy_image()` in `backend/app/routes/booru_import.py` only checks whether the value starts with http, then uses `get_client_for_url` or `requests.get` and streams the response. Private, loopback and link-local addresses are not blocked, and automatically followed redirects can move a request from a trusted domain to an internal address. An authenticated administrator can enumerate internal services and access cloud instance metadata, potentially disclosing IAM credentials and crossing the application&#39;s intended cloud or network trust boundary. The reporter also observed a hanging recursive self-request. Administrator authentication remains a prerequisite; this is not an anonymous proxy. This issue is fixed in version 1.40.0.</p> https://db.gcve.eu/vuln/cve-2026-57448