Go-Shiori

4 CVEs across 1 Go-Shiori products. Browse Go-Shiori vulnerabilities, severities, and proof-of-concept exploits.

Go-Shiori products with known CVEs

ProductCVEs
Shiori4
Go-Shiori CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-71280High8.52026-08-05go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destina…
CVE-2026-71206High8.32026-08-05Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, neve…
CVE-2026-61463High8.82026-07-13Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authoriza…
CVE-2025-60538Medium6.52026-01-09A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.