CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

flaskbb-plugin-atom (>=0.1.0, <=0.2.0), flaskbb-plugin-conversations (>=2.0.1, <=2.0.2) +6 more potentially affected by CVE-2026-46556 via flaskbb (2.2.0)

flaskbb PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flaskbb and may be impacted: - flaskbb-plugin-atom =0.1.0, =2.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0 Source cves: CVE-2026-46556 Source advisory: SNYK:PYTHON-FLASKBB-17283331...