CVE-2026-71280

Summary

The flaw allows an attacker to exploit go-shiori's DownloadBookmark function by providing a malicious URL, leading to potential unauthorized access or execution of code.

Exploitability

Exploitation is relatively straightforward as it requires only a caller-supplied URL without any validation, making it easy for an attacker to inject a malicious URL.

Blast radius

If exploited, the impact could be significant, potentially leading to unauthorized access to sensitive data or execution of arbitrary code on the affected system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of go-shiori that addresses this vulnerability, specifically version 2.590 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.