What is the CVSS score of EUVD-2026-53365?

EUVD-2026-53365 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Shiori are affected by EUVD-2026-53365?

Shiori's bookmark management feature contains a server-side request forgery vulnerability that enables authenticated users to extract cloud credentials and access internal-only databases and APIs.

How to fix or mitigate EUVD-2026-53365?

Within 24 hours, identify all Shiori deployments and disable the bookmark download feature (or restrict to administrative accounts) until a patch is available; immediately audit recent download requests for suspicious activity to 127.0.0.1 and 0.0.0.0. Within 7 days, deploy network-level mitigations: configure egress filtering to block your Shiori servers from reaching cloud metadata endpoints (e.g., 169.254.169.254 on AWS) and internal-only network ranges; implement strict IP whitelisting for all legitimate outbound connections Shiori requires. Within 30 days, monitor the Shiori project for security patches and prepare an expedited update plan; if no patch is available within 90 days, evaluate alternative bookmark management solutions.

Shiori EUVD-2026-53365

| CVE-2026-71280 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-05 TuranSec

GHSA-5mx2-758c-cg2x

SSRF Shiori Go Shiori

8.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Network-reachable API requires a user account (PR:L); scope changes because the server pivots to internal systems; C:H reflects cloud credential exfiltration potential via metadata endpoints.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:43 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 8.5

DescriptionCVE.org

go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast() checks). An authenticated user creating or updating a bookmark via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext can supply a loopback (127.0.0.1) or 0.0.0.0 (which Linux redirects to loopback) URL, causing the server to make outbound requests to internal-only services, cloud metadata endpoints, or other network-restricted resources.

AnalysisAI

Server-Side Request Forgery in Shiori's bookmark download function allows any authenticated user to force the server to issue HTTP requests to loopback addresses (127.0.0.1) and 0.0.0.0 - which Linux routes to the loopback interface - reaching cloud metadata endpoints, co-located databases, and internal-only APIs. The root cause is DownloadBookmark() in internal/core/download.go using a plain http.Client with no custom DialContext and no post-resolution IP validation (no IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast() checks). No public exploit has been identified at time of analysis, but the attack path is trivially constructable given the well-documented SSRF pattern against Go's standard HTTP client.

Technical ContextAI

Shiori is an open-source self-hosted bookmark manager written in Go (CPE: cpe:2.3:a:go-shiori:shiori:*:*:*:*:*:*:*:*). The flaw is in DownloadBookmark() (internal/core/download.go), which accepts a caller-supplied URL and fetches it using Go's stdlib http.Client with no transport-layer restrictions. CWE-918 (Server-Side Request Forgery) is the root cause class: the server acts as an unguarded HTTP proxy for user-controlled destinations. Go's http.Client resolves DNS and connects to the resulting IP without any post-resolution filtering, meaning addresses in RFC-1918 private ranges, loopback (127.0.0.0/8), link-local (169.254.0.0/16), and the special 0.0.0.0 address (which the Linux kernel routes to the loopback interface) are all reachable. Three distinct API endpoints are affected: POST /api/bookmark, PUT /api/v1/bookmarks/cache, and POST /api/bookmarks/ext, giving the attacker multiple trigger surfaces.

RemediationAI

No vendor-released patch has been identified at time of analysis. The correct fix is implementing a custom DialContext in the http.Client used by DownloadBookmark() that resolves the destination address and then validates it with Go's net.IP methods - blocking IsLoopback(), IsPrivate(), IsUnspecified(), and IsLinkLocalUnicast() before the connection proceeds; the connection should be refused if any check triggers. As a compensating control while awaiting a patch, administrators should apply host-level firewall rules (iptables/nftables) blocking outbound connections from the Shiori process to 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16 - note that iptables OUTPUT rules affect all processes unless constrained by uid/gid matching, so scoping the rule to Shiori's runtime user reduces side effects. In cloud environments, additionally enforce IMDSv2 (token-required mode) on EC2 instances to prevent credential theft via 169.254.169.254 even if SSRF is triggered. Restricting bookmark creation permissions to a minimal set of trusted accounts provides defense-in-depth. Monitor the upstream repository at https://github.com/go-shiori/shiori for patch releases.