Vulnerability · Published Aug 5, 2026 · Assigned by TuranSec

CVE-2026-71280go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch

High 8.5

In plain English

A high-severity server-side request forgery in shiori from go-shiori. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.3%top 77.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).

Affected products (as reported)

Vendor	Product	Versions
go-shiori	shiori	0 – through *

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

https://github.com/go-shiori/shiori third-party-advisory
https://github.com/go-shiori/shiori/blob/master/internal/core/download.go third-party-advisory