CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

flaskbb-plugin-atom (>=0.1.0, <=0.2.0), flaskbb-plugin-conversations (>=2.0.1, <=3.0.4) +7 more potentially affected by CVE-2026-46556 via flaskbb (>=2.2.0, <=3.0.0rc3)

flaskbb PYPI version =2.2.0, =0.1.0, =2.0.1, =0.0.1, =0.1.0, =2.0.0, =0.0.1, =0.1.0 Source cves: CVE-2026-46556 Source advisory: SNYK:PYTHON-FLASKBB-17283331...