The vulnerability exists in the DownloadBookmark() function of go-shiori's shiori application (internal/core/download.go). It fetches a user-supplied bookmark URL using a standard http.Client without any custom DialContext or checks to validate the destination IP address. Specifically, it lacks checks such as IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast(). As a result, an authenticated user can create or update a bookmark with a URL pointing to loopback addresses (e.g., 127.0.0.1) or 0.0.0.0, which Linux redirects to loopback. This causes the server to make outbound requests to internal-only services, cloud metadata endpoints, or other network-restricted resources, potentially exposing sensitive internal data or services.

An attacker with authenticated access can leverage this vulnerability to make the server perform SSRF (Server-Side Request Forgery) attacks against internal network resources. This can lead to unauthorized disclosure of sensitive information from internal services or cloud metadata endpoints. The CVSS score of 8.5 reflects high impact on confidentiality with limited integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user ability to supply arbitrary bookmark URLs or implement network-level controls to prevent the server from making requests to internal or loopback addresses. Monitoring and filtering outbound requests from the server may also help mitigate risk.