Go-shiori vulnerabilities
Published CVEs affecting Go-shiori products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-71280
High · 8.5
CWE-918 Aug 5, 2026
go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch
go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).
CVE-2026-61463
High · 8.8
CWE-269 Jul 13, 2026
Shiori Authenticated Privilege Escalation via PATCH /api/v1/auth/account
Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.
CVE-2025-60538
Medium · 6.5
CWE-290 Jan 9, 2026
Authentication Bypass by Spoofing in Go-shiori Shiori
A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.