{"id":"GHSA-jhm9-h84h-rw83","aliases":["BIT-phpbb-2020-8226","CVE-2020-8226"],"title":"phpBB Server-Side Request Forgery Vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.","severity":"medium","score":5.8,"published":"2022-05-24T17:26:05.000Z","modified":"2023-12-06T01:00:40.536Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phpbb/phpbb","sources":[{"name":"OSV · GHSA-jhm9-h84h-rw83","url":"https://osv.dev/vulnerability/GHSA-jhm9-h84h-rw83"}],"ranges":[{"events":[{"introduced":"3.2.0"},{"fixed":"3.2.10"}],"type":"ECOSYSTEM"}],"versions":["3.2.0","3.2.1","3.2.1-RC1","3.2.10-RC1","3.2.10-RC2","3.2.2","3.2.2-RC1","3.2.3","3.2.3-RC1","3.2.3-RC2","3.2.4","3.2.4-RC1","3.2.5","3.2.5-RC1","3.2.6","3.2.6-RC1","3.2.7","3.2.7-RC1","3.2.8","3.2.8-RC1","3.2.9","3.2.9-RC1"],"fixed":["3.2.10"]},{"ecosystem":"Packagist","name":"phpbb/phpbb","sources":[{"name":"OSV · GHSA-jhm9-h84h-rw83","url":"https://osv.dev/vulnerability/GHSA-jhm9-h84h-rw83"}],"ranges":[{"events":[{"introduced":"3.3.0"},{"fixed":"3.3.1"}],"type":"ECOSYSTEM"}],"versions":["3.3.0","3.3.1-RC1"],"fixed":["3.3.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-8226","https://github.com/phpbb/phpbb-app/commit/0cfaaafb386d58576d200d56f1acdbcc2f2376e8","https://github.com/phpbb/phpbb-app/commit/efc0a146bf12125eeb71d00470af774326a7bf0a","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpbb/phpbb/CVE-2020-8226.yaml","https://github.com/phpbb/phpbb-app","https://www.phpbb.com/community/viewtopic.php?f=14&t=2562631","https://www.phpbb.com/community/viewtopic.php?f=14&t=2562636"],"sources":[{"name":"OSV","id":"GHSA-jhm9-h84h-rw83","modified":"2023-12-06T01:00:40.536642Z","url":"https://osv.dev/vulnerability/GHSA-jhm9-h84h-rw83"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:20:32.181Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}