PyPI/flaskbb CVE-2026-46556: medium 6.5, EPSS 0.35%

FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-xq32-9g7q-7297
• https://github.com/flaskbb/flaskbb/security/advisories/GHSA-xq32-9g7q-7297
• https://github.com/flaskbb/flaskbb

CVE-2026-46556 · published 2026-05-21T20:42:09Z · modified 2026-07-13T16:42:35.763564080Z · JSON