CVE-2026-71280 — go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch

CVE-2026-71280

go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch PUBLISHED

Description (CNA)

go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).

Affected (CNA)

Vendor / product	Versions
go-shiori / shiori	affected 0 through *

CWE

CWE-918

References

https://github.com/go-shiori/shiori
https://github.com/go-shiori/shiori/blob/master/internal/core/download.go

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.