CVE-2026-123201

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch data or /api/network handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is bad url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.