Read the docs
TI-2026-85580 Aliases CVE-2026-123201GHSA-jrwq-3w4r-c27c

Server-side request forgery in Buku bukuserver reaches internal hosts

Priority LOW 28CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Buku (bukuserver) through 5.1.1 contains a server-side request forgery flaw (CWE-918) in its /api/fetch_data and /api/network_handle endpoints. The URL check, is_bad_url(), is weak: it fails to block requests to loopback, private, or cloud metadata addresses, and redirects are followed. An unauthenticated remote attacker can supply a url parameter to make the server reach internal services and read their page titles, descriptions, and keywords.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

Why it matters now

EPSS 0.00394 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jarunbukuup to 5.1.1—No fix listedCNA
  • buku Vendorjarun Affected up to 5.1.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for buku.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123201
  2. 2026-11-05 Alias added: GHSA-jrwq-3w4r-c27c
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat
  5. 2026-11-07 Priority changed: MEDIUM → LOW

References

Patch 2

Other 3

  • TI-2026-84354 OS command injection in nnn togglex plugin via crafted filenames CVSS 4.0HIGH 8.4
  • TI-2026-84355 nnn Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins CVSS 4.0MEDIUM 4.1
  • TI-2026-84450 Stored cross-site scripting in buku bookmark list via bookmark URL CVSS 4.0MEDIUM 5.3
  • TI-2025-12396 jarun nnn nnn.c run_cmd_as_plugin double free CVSS 4.0MEDIUM 4.8
  • TI-2026-84356 Symlink-following write in nnn via NNN_FIFO handling CVSS 4.0LOW 1.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences