CyberRota Analysis
AI-GeneratedThe vulnerability affects go-shiori on Linux, where the DownloadBookmark() function allows authenticated users to supply arbitrary URLs, including loopback addresses, leading to unauthorized outbound requests to internal services or cloud metadata endpoints. This can result in data exposure and potential compromise of sensitive internal resources. Organizations using go-shiori should prioritize patching this vulnerability to mitigate risks associated with unauthorized access to internal network services.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).