Live › vulnerability › CVE-2026-14467
The Forocoches comments editor allowed images pointing to external URLs. A viewer's browser fetched them, so the attacker's server saw the viewer's IP, User-Agent and access time. INCIBE says the Forocoches team has fixed it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 10:29 UTC. All times on this page are UTC.
Visitors who open Forocoches discussion threads containing attacker-inserted images are exposed to having their IP address and browser metadata collected. The sources do not say whether the site has deployed a fix or what configuration would change the exposure. Teams running the forum software themselves should check whether their comment editor allows external image URLs.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.
This page as .md · .json · in your agent: get_signal("CVE-2026-14467")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.