go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destin…

CVE-2026-71280 describes a Server-Side Request Forgery (SSRF) vulnerability in the go-shiori bookmark manager application. The DownloadBookmark() function in internal/core/download.go fetches user-supplied URLs using a plain http.Client without any destination IP validation. No checks are performed for loopback, private, unspecified, or link-local unicast addresses. An authenticated attacker can abuse bookmark creation or update API endpoints (POST /api/bookmark, PUT /api/v1/bookmarks/cache, POST /api/bookmarks/ext) to supply internal addresses such as 127.0.0.1 or 0.0.0.0. This causes the server to make outbound HTTP requests to internal services, cloud metadata endpoints (e.g., AWS IMDSv1), or other network-restricted resources. The vulnerability requires authentication but poses significant risk in cloud-hosted or shared environments. Remediation requires implementing a custom DialContext with strict IP validation before establishing outbound connections.