2026年9月4日

CVE-2026-71280 [HIGH] – go-shiori’s DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmar

未分类

📑 文章目录

go-shiori’s DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).

相关文章