CVE-2026-71280 go-shiori CVE debrief

Who should care

Users of go-shiori, especially those who allow authenticated users to create or update bookmarks, should be aware of this vulnerability and take steps to mitigate it. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security of go-shiori deployments. They should review and update the authentication and authorization mechanisms for creating and updating bookmarks and consider implementing a deny list for known internal or restricted resources.

Technical summary

The DownloadBookmark() function in go-shiori's internal/core/download.go uses a plain http.Client without custom DialContext or destination-IP validation. This allows an authenticated user to supply a URL that causes the server to make requests to internal or restricted resources, such as loopback (127.0.0.1) or 0.0.0.0 addresses. The affected product context includes go-shiori deployments where authenticated users can create or update bookmarks. The defensive impact involves implementing IP address validation to prevent requests to loopback or private IP addresses and monitoring server logs for unusual outbound requests.

Defensive priority

Authenticated users with limited privileges can supply URLs that cause the server to make unintended requests to internal or restricted resources.

Recommended defensive actions

• Verify and restrict the URLs that can be supplied to the DownloadBookmark() function
• Implement IP address validation to prevent requests to loopback or private IP addresses
• Monitor server logs for unusual outbound requests
• Consider implementing a deny list for known internal or restricted resources
• Review and update the authentication and authorization mechanisms for creating and updating bookmarks

Evidence notes

The CVE description indicates that go-shiori's DownloadBookmark() function fetches caller-supplied URLs without validating if they are loopback or private IP addresses. An authenticated user can create or update a bookmark with a URL like 127.0.0.1 or 0.0.0.0, which can cause the server to make requests to internal services or cloud metadata endpoints.

Official resources