The vulnerability in go-shiori's shiori component is due to the DownloadBookmark function using a standard http.Client to fetch URLs supplied by callers without any destination IP validation. Specifically, it does not perform checks to prevent requests to internal or local network addresses (e.g., loopback, private IP ranges), which is categorized under CWE-918 (Server-Side Request Forgery via IP Validation Bypass). This can allow an attacker with limited privileges to cause the server to make unintended HTTP requests to internal resources, potentially exposing sensitive information or affecting system integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, and results in high confidentiality impact, low integrity impact, and no availability impact. No patch or official remediation level has been published by the vendor as of the data provided.

An attacker with the ability to supply bookmark URLs to the DownloadBookmark function can exploit this vulnerability to make the server perform HTTP requests to internal or otherwise restricted network addresses. This can lead to unauthorized information disclosure (high confidentiality impact) and limited integrity impact. There is no reported impact on availability. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting or validating URLs passed to the DownloadBookmark function to prevent requests to internal or sensitive network addresses. Implementing IP address validation to block loopback, private, unspecified, and link-local unicast addresses is recommended as a temporary mitigation.