blombooru vulnerabilities

CVEs whose affected-version data names the blombooru package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-57448Medium· 6.2PoC

1w ago

Blombooru: administrator image-proxy server-side request forgery

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `/api/booru-import/proxy-image`, accepts a `url` query parame…

▾ Twilightmrblomblo · blombooruEPSS 0.34%via CVEORG