{"id":"CVE-2026-71280","published":"2026-08-05T13:24:52.573","lastModified":"2026-08-10T12:17:30.580","description":"go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/go-shiori/shiori","tags":[]},{"url":"https://github.com/go-shiori/shiori/blob/master/internal/core/download.go","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-shiori/shiori","tags":[]},{"url":"https://github.com/go-shiori/shiori/blob/master/internal/core/download.go","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to exploit go-shiori's DownloadBookmark function by providing a malicious URL, leading to potential unauthorized access or execution of code.","exploitability":"Exploitation is relatively straightforward as it requires only a caller-supplied URL without any validation, making it easy for an attacker to inject a malicious URL.","blast_radius":"If exploited, the impact could be significant, potentially leading to unauthorized access to sensitive data or execution of arbitrary code on the affected system.","remediation":"Upgrade to the latest version of go-shiori that addresses this vulnerability, specifically version 2.590 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","http","security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:49:42.217Z"}}