CVE-2026-57448

Blombooru versions prior to 1.40.0 are vulnerable to Server-Side Request Forgery (SSRF) via the administrator-only GET /proxy-image endpoint (exposed as /api/booru-import/proxy-image). The proxy_image() function in backend/app/routes/booru_import.py fails to perform meaningful destination validat...