go‑shiori’s DownloadBookmark routine creates HTTP requests with an unconfigured client, performing no validation of the destination address. Because the client does not check for loopback, private or link‑local addresses, the application can be forced to retrieve content from any URL supplied by a caller, which constitutes a server‑side request forgery vulnerability. The flaw allows the server to access internal services or resources that are normally unreachable from the client side, potentially exposing internal data or facilitating lateral movement within the network.

The CVE entry does not list specific affected versions. Any instance of go‑shiori that contains the unpatched DownloadBookmark routine is vulnerable; all current releases that have not applied the fix fall into this category.

The CVSS score of 8.5 classifies this as a high‑severity issue. With an EPSS score of less than 1% and no listing in the CISA KEV catalog, the probability of exploitation is currently low, but the potential impact is significant. The attack requires an attacker to provide a revocable request to the vulnerable endpoint; if the endpoint is publicly accessible, the attacker can supply arbitrary URLs and cause the server to perform unauthorized network requests.