CVE-2026-71280: go-shiori SSRF Vulnerability

CVE-2026-71280 Overview

CVE-2026-71280 is a Server-Side Request Forgery (SSRF) vulnerability in go-shiori/shiori, a self-hosted bookmark manager written in Go. The DownloadBookmark() function in internal/core/download.go fetches caller-supplied URLs through a plain http.Client without validating the destination IP address. An authenticated user can submit URLs pointing to loopback, private, or link-local addresses through bookmark creation endpoints. The server then issues outbound requests to internal-only services and cloud metadata endpoints on behalf of the attacker. This weakness is tracked as CWE-918.

Critical Impact
Authenticated attackers can pivot from a public shiori instance into internal networks, reaching cloud metadata services (169.254.169.254), localhost-bound admin panels, and other network-restricted assets.

Affected Products

go-shiori/shiori (bookmark manager)
internal/core/download.go — DownloadBookmark() function
API endpoints: POST /api/bookmark, PUT /api/v1/bookmarks/cache, POST /api/bookmarks/ext

Discovery Timeline

2026-08-05 - CVE-2026-71280 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71280

Vulnerability Analysis

The flaw resides in the DownloadBookmark() function within internal/core/download.go. The function accepts a bookmark URL supplied by an authenticated user and dispatches an HTTP request using Go's default http.Client. No custom DialContext is configured, and the destination IP is never inspected.

Go provides standard helpers such as IsLoopback(), IsPrivate(), IsUnspecified(), and IsLinkLocalUnicast() on the net.IP type. None of these checks are applied before the outbound request. As a result, the server treats internal and external addresses identically.

The impact is amplified by Linux kernel behavior. Requests to 0.0.0.0 are redirected to the loopback interface, providing an additional bypass path for any naive blocklist targeting only 127.0.0.1 or localhost.

Root Cause

The root cause is missing destination validation on user-controlled URLs before HTTP fetching. Shiori trusts the input URL and delegates DNS resolution and connection establishment to the default transport. This design collapses the trust boundary between the authenticated user and the server's network position.

Attack Vector

An authenticated user submits a bookmark URL such as http://127.0.0.1:8080/admin, http://0.0.0.0/, or http://169.254.169.254/latest/meta-data/ through one of the three affected endpoints. Shiori resolves the host and issues an HTTP GET from its own network context. The response, including HTML content and page metadata, is returned to the attacker through the bookmark cache. Attackers can enumerate internal services, retrieve cloud instance metadata credentials, or interact with unauthenticated admin interfaces reachable only from the shiori host.

No verified exploit code is published. Technical details are available in the shiori source repository.

Detection Methods for CVE-2026-71280

Indicators of Compromise

Outbound HTTP requests from the shiori process to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) addresses.
Bookmark records containing URLs referencing internal hostnames, localhost, 127.0.0.1, or 0.0.0.0.
Access log entries on internal services showing the shiori server's source IP as an unexpected client.

Detection Strategies

Inspect the shiori database bookmark table for url values pointing to private, loopback, or metadata addresses.
Correlate authenticated API calls to /api/bookmark, /api/v1/bookmarks/cache, and /api/bookmarks/ext with subsequent egress connections from the shiori host.
Alert on any request from the shiori process to 169.254.169.254, which serves AWS, Azure, and GCP instance metadata.

Monitoring Recommendations

Enable egress logging on the shiori host and forward connection metadata to a centralized SIEM.
Monitor cloud metadata service access logs where available (for example, IMDSv2 token issuance events on AWS).
Track new user account creation on the shiori instance, since authentication is a prerequisite for exploitation.

How to Mitigate CVE-2026-71280

Immediate Actions Required

Restrict shiori's outbound network access using host firewall rules or Kubernetes NetworkPolicies that block RFC1918, loopback, and link-local destinations.
Enforce AWS IMDSv2 (or equivalent controls on Azure and GCP) to require session tokens for metadata retrieval.
Audit existing bookmarks for URLs referencing internal addresses and purge suspicious entries.
Limit account provisioning on public-facing shiori instances until a patched release is deployed.

Patch Information

No fixed version is listed in the NVD entry at time of publication. Monitor the go-shiori/shiori releases page for a security update that introduces destination-IP validation in DownloadBookmark(). A correct fix implements a custom DialContext that rejects addresses matching IsLoopback(), IsPrivate(), IsUnspecified(), and IsLinkLocalUnicast().

Workarounds

Deploy shiori behind an egress proxy that whitelists only public internet destinations.
Run the shiori container in a network namespace with no route to internal subnets or the cloud metadata endpoint.
Disable or restrict access to the affected bookmark creation endpoints via a reverse proxy until a patch is applied.

bash

# Example iptables rules blocking internal egress from the shiori host
iptables -A OUTPUT -m owner --uid-owner shiori -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner shiori -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner shiori -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner shiori -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner shiori -d 169.254.0.0/16 -j REJECT