Shiori CVE-2026-71280

Exploitation requires a valid authenticated user account on the Shiori instance (CVSS PR:L - low-privilege authentication). The attacker must have access to at least one of the three affected HTTP endpoints: POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext. The targeted internal resource must be reachable from the Shiori server process (loopback services are always reachable; metadata endpoints require a cloud environment; private-range services require network adjacency). The 0.0.0.0 loopback bypass technique is Linux-specific - on non-Linux platforms, 0.0.0.0 may not route to loopback and this specific bypass may not apply, though direct 127.0.0.1 targeting remains universal. No special Shiori configuration is required beyond the presence of a user account. Exploitation is most impactful on cloud-hosted instances (IMDSv1 accessible) or hosts with co-located sensitive services (Redis, Elasticsearch, internal HTTP APIs). The authentication requirement (PR:L) limits exposure compared to unauthenticated SSRF, but offers minimal protection in deployments with open registration or shared credentials.

The CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) is well-calibrated: the Scope:Changed designation correctly captures that Shiori becomes a pivot point into adjacent internal systems outside its own security boundary, with high confidentiality impact reflecting potential exfiltration of cloud IAM credentials or internal service data. Authentication (PR:L) is the primary real-world limiting factor - any registered user can exploit this, which is meaningful for personal deployments but weak protection on multi-tenant or publicly accessible instances. Shiori is not listed in CISA KEV, and no EPSS score was provided; active exploitation is not confirmed. No POC code has been identified in the provided data. Despite the absence of a KEV listing, the SSRF pattern targeting cloud metadata (e.g., AWS IMDSv1 at 169.254.169.254) and the 0.0.0.0 Linux bypass are both well-understood and require no special tooling to weaponize, making practical risk higher than KEV/EPSS absence might suggest for cloud-hosted instances. The wildcard CPE (all versions) signals that no patched release has been confirmed.

An authenticated Shiori user submits a new bookmark via POST /api/bookmark with the URL set to http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name, targeting the AWS instance metadata service. The server's DownloadBookmark() fetches the URL through the unprotected http.Client, the cloud metadata service returns IAM temporary credentials in the response body, and Shiori stores or returns this content to the attacker. Alternatively, supplying http://0.0.0.0:6379/ on a Linux host with a co-located Redis instance sends raw HTTP bytes to Redis's TCP port, potentially reading keyspace data or executing commands via HTTP-pipelining techniques.