The vulnerability is introduced by a weak validation in the is_bad_url() function used by Buku's bukuserver. An attacker can supply any URL to the /api/fetch_data or /api/network_handle endpoints, and the server then performs an HTTP request to that URL, following redirects without restriction. This allows the attacker to trigger requests against internal services, receive basic page metadata such as titles, descriptions, and keywords, and thereby map internal resources.

All installations of jarun's Buku up to and including version 5.1.1 are affected; the flaw exists regardless of authentication, so any user who can reach the API endpoints can exploit it.

The CVSS score of 6.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw without credentials by sending requests over HTTP or HTTPS to /api/fetch_data or /api/network_handle. By targeting loopback, private network ranges, or cloud metadata IP addresses, an adversary can discover internal services and potentially expose sensitive data if other weaknesses exist.