{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123201", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T17:58:50.301Z", "datePublished": "2026-11-05T18:16:37.726Z", "dateUpdated": "2026-11-05T18:16:37.726Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:37.726Z"}, "datePublic": "2026-11-02T00:00:00.000Z", "title": "buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API", "descriptions": [{"lang": "en", "value": "Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "affected": [{"vendor": "jarun", "product": "buku", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "5.1.1", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:pypi/buku", "repo": "https://github.com/jarun/buku"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/jarun/buku/issues/910", "tags": ["issue-tracking"]}, {"url": "https://github.com/jarun/buku/pull/916", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/jarun/buku/commit/13f6497afc974f02f1069b760772abe8815d1675", "tags": ["patch"]}, {"url": "https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/bukuserver/api.py#L97-L105", "tags": ["technical-description"]}, {"url": "https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/buku.py#L4057-L4084", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/buku-through-5.1.1-ssrf-via-bukuserver-fetch-data-and-network-handle-api"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}, {"lang": "en", "value": "LeXofLeviafan", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/buku", "product": "buku", "repo": "https://github.com/jarun/buku", "vendor": "jarun", "versions": [{"lessThanOrEqual": "5.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords."}], "id": "CVE-2026-123201", "lastModified": "2026-11-05T19:17:19.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T19:17:19.153", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/buku.py#L4057-L4084"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/bukuserver/api.py#L97-L105"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/buku/commit/13f6497afc974f02f1069b760772abe8815d1675"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/buku/issues/910"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/buku/pull/916"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/buku-through-5.1.1-ssrf-via-bukuserver-fetch-data-and-network-handle-api"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "buku: buku: Information disclosure via Server-Side Request Forgery in bukuserver", "id": "2567713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567713"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in buku. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery (SSRF) due to improper URL validation in the bukuserver component. By supplying crafted web addresses to API endpoints, an attacker can coerce the server into sending requests to internal network resources, loopback addresses, or cloud metadata services to discover services and retrieve sensitive data."], "mitigation": {"lang": "en:us", "value": "Restrict network reachability to the web server daemon or disable the web interface:\n1. If the web UI is not strictly required, stop the bukuserver process and manage bookmarks solely through the command-line interface. If managed as a system service:\n# systemctl stop bukuserver\n# systemctl disable bukuserver\n2. If the web interface must remain active, ensure bukuserver binds strictly to the loopback address (127.0.0.1) rather than public interfaces, and block external network traffic to the service port (default 5001/tcp) using firewalld:\n# firewall-cmd --permanent --remove-port=5001/tcp\n# firewall-cmd --reload\nCaveat: Disabling the service or blocking the port prevents remote web access to bookmark management. Warning: Reloading firewalld immediately refreshes active firewall rules and terminates external sessions."}, "name": "CVE-2026-123201", "public_date": "2026-11-05T18:16:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123201\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123201\nhttps://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/buku.py#L4057-L4084\nhttps://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/bukuserver/api.py#L97-L105\nhttps://github.com/jarun/buku/commit/13f6497afc974f02f1069b760772abe8815d1675\nhttps://github.com/jarun/buku/issues/910\nhttps://github.com/jarun/buku/pull/916\nhttps://www.vulncheck.com/advisories/buku-through-5.1.1-ssrf-via-bukuserver-fetch-data-and-network-handle-api"], "statement": "This vulnerability is rated as Moderate because the flaw is limited to unauthorized read-only reconnaissance of internal network assets without granting write access or remote code execution. In typical Red Hat environments, the core command-line bookmark manager does not expose network services by default; risk is introduced only if the optional web server daemon is explicitly launched and reachable over untrusted networks. Furthermore, the severity is bounded because an attacker can only harvest basic web metadata from reached intranet endpoints rather than compromising the host operating system.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.1.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "buku", "source": "cna", "vendor": "jarun"}, "product": "buku", "vendor": "jarun"}], "created": "2026-11-05T20:00:09.809446+00:00", "updated": "2026-11-06T16:35:34.868490+00:00", "vendors": ["jarun", "jarun$PRODUCT$buku"], "weaknesses": ["CWE-918"]}