CVE-2026-71280
Received Received - Intake

Command Injection in go-shiori Bookmark Processing

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast() checks). An authenticated user creating or updating a bookmark via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext can supply a loopback (127.0.0.1) or 0.0.0.0 (which Linux redirects to loopback) URL, causing the server to make outbound requests to internal-only services, cloud metadata endpoints, or other network-restricted resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71280
EUVD
EUVD-2026-53365

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-shiori shiori *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in go-shiori allows authenticated users to supply a loopback or 0.0.0.0 URL when creating or updating a bookmark. The server then makes outbound requests to internal-only services or restricted resources without validating the destination IP address.

Detection Guidance

Check server logs for outbound requests to loopback addresses (127.0.0.1, ::1), 0.0.0.0, or private IP ranges from the go-shiori process. Monitor network traffic for unexpected connections to internal services or cloud metadata endpoints originating from the application.

Impact Analysis

An attacker could exploit this to access internal services, exfiltrate data, or interact with cloud metadata endpoints. This could lead to unauthorized access, data leaks, or service disruption if internal resources are compromised.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to internal systems or sensitive data. It may result in non-compliance due to insufficient network isolation and lack of proper access controls.

Mitigation Strategies

Update go-shiori to a patched version that implements DialContext with destination-IP validation (IsLoopback, IsPrivate checks). Restrict network access to prevent outbound connections to loopback or private IPs. Review and remove any bookmarks pointing to internal or restricted addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart