Go Shiori vulnerabilities
4 vulnerabilities
Known vulnerabilities in Go Shiori products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Shiori4 vulnerabilities
RoutineCVE-2026-71280go-shiori · shiorigo-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetchgo-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).CVSS8.5HighEPSS0.30%RoutineCVE-2026-71206go-shiori · shiorishiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or DemotionShiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.CVSS8.3HighEPSS0.37%RoutineCVE-2026-61463go-shiori · shioriShiori Authenticated Privilege Escalation via PATCH /api/v1/auth/accountShiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.CVSS8.8HighEPSS0.47%RoutineCVE-2025-60538go-shiori · shiori +1 morego-shiori shioriA lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.CVSS6.5MediumEPSS0.41%