CVE-2026-71280: go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch
go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast() checks). An authenticated user creating or updating a bookmark via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext can supply a loopback (127.0.0.1) or 0.0.0.0 (which Linux redirects to loopback) URL, causing the server to make outbound requests to internal-only services, cloud metadata endpoints, or other network-restricted resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement destination-IP validation in DownloadBookmark() to reject bookmark URLs that resolve to loopback (127.0.0.1) or unspecified (0.0.0.0, which Linux redirects to loopback), before making outbound requests.
go-shiori (DownloadBookmark / internal/core/download.go) Destination URL validation = disallow loopback and unspecified addresses - Compensating control
Add network egress controls so the go-shiori server cannot make outbound HTTP requests to internal-only destinations, cloud metadata endpoints, or other network-restricted resources (e.g., block destinations like 127.0.0.1/loopback and 0.0.0.0/loopback-redirect at the network/firewall or via egress policy).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71280?
CVE-2026-71280 has a severity rating of 8.5, categorized as high.
How does CVE-2026-71280 affect go-shiori?
CVE-2026-71280 allows for server-side request forgery (SSRF) through unrestricted bookmark URL fetching.
What are the potential impacts of CVE-2026-71280?
Exploitation of CVE-2026-71280 can lead to sensitive data exposure and unauthorized access to internal services.
How do I fix CVE-2026-71280?
To fix CVE-2026-71280, ensure that the method used to fetch URLs includes proper validation and checks for loopback, private, and unspecified addresses.
Who is affected by CVE-2026-71280?
Authenticated users of go-shiori who can create or update bookmarks are affected by CVE-2026-71280.