CVE-2026-39383
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Gotenberg version 8.29.1 has a blind SSRF vulnerability. An unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url header.
Risk Assessment
An attacker can probe internal network infrastructure, force POST requests against internal services, and confirm reachability of cloud metadata endpoints, potentially leading to further attacks.
Recommendation
Update Gotenberg to version 8.31.0 or configure the GOTENBERG_API_WEBHOOK_ALLOW_LIST and GOTENBERG_API_WEBHOOK_DENY_LIST environment variables to restrict allowed webhook URLs.
Other vulnerabilities in Gotenberg
See all- CVE-2026-45742High
Gotenberg from version 8.10.0 until 8.33.0 has a race condition in the newContext function in pkg/modules/api/context.go, where multiple goroutines concurrently write to shared maps and slices. A crafted multipart request with many downloadFrom entries can trigger a fatal 'concurrent map writes' runtime error and terminate the process. The default configuration allows unauthenticated remote attacks, leading to denial of service. This issue is fixed in version 8.33.0.
- CVE-2026-42595High
Gotenberg is a PDF file API that prior to version 8.32.0 lacked default protection against HTTP/HTTPS-based SSRF attacks. An attacker could point Chromium at any internal IP and receive a response rendered as a PDF.
- CVE-2026-42590High
Gotenberg is a PDF file API that prior to version 8.30.0 had a vulnerability allowing the bypass of ExifTool's metadata write blocklist. Using ExifTool's group-prefix syntax, an attacker could rename, move, and create hard and soft links on the server.
- CVE-2026-40893High
Gotenberg is a stateless API for PDF files that prior to version 8.31.0 did not properly check tags, allowing remote attackers to move, rename, and change permissions for arbitrary files.
- CVE-2026-45741High
Gotenberg in version 8.32.0 and earlier has a vulnerability in the IsPublicIP function that does not reject IPv6 prefixes such as 2002::/16, 64:ff9b::/96, fec0::/10, and others that can embed or route to non-public IPv4 destinations. A crafted DNS AAAA record can cause the outbound HTTP client to treat an address wrapping an internal destination (e.g., 169.254.169.254) as public, allowing access to cloud metadata services. This issue is fixed in version 8.33.0.
- CVE-2026-44829High
Gotenberg in version 8.32.0 and earlier has a vulnerability in filename handling where filepath.Base on Linux does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. A remote attacker can submit such a name, and when the resulting archive is extracted on a Windows system, files can be written outside the intended directory. This issue is fixed in version 8.33.0.
- CVE-2026-55229High
A vulnerability in Gotenberg prior to version 8.34.0 allows blind SSRF and limited local file disclosure via a specially crafted document sent to the /forms/libreoffice/convert endpoint. LibreOffice automatically retrieves external HTTP(S) resources and local files during document conversion.
- CVE-2026-40280High
Gotenberg versions 8.30.1 and earlier use the regular expression ^https?:// to check URLs in private IP deny-lists. Since Go normalizes the URL scheme to lowercase before establishing a connection, an attacker can bypass the block by using uppercase letters in the scheme (e.g., HTTP://). This allows unauthenticated requests to internal network services, including cloud metadata endpoints.
- CVE-2024-21527High
SSRF vulnerability in Gotenberg before version 8.1.0 allows local file inclusion via the /convert/html endpoint. An attacker can use an iframe pointing to localhost, e.g., <iframe src="\\localhost/etc/passwd">, leading to reading sensitive system files.
Original NVD description (English source)
Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url request header. The FilterDeadline function in filter.go is intended to gate outbound URLs, but when both the allow-list and deny-list are empty (the default configuration), it returns nil unconditionally and permits any URL. This is a blind SSRF: Gotenberg POSTs the converted document to the webhook URL and only checks whether the response status code is an error, but never returns the target's response body to the attacker. An attacker can use this to probe internal network infrastructure by observing whether the error callback is invoked, force POST requests against internal services that perform side effects, and confirm reachability of cloud metadata endpoints. The retryable HTTP client issues up to 4 automatic retries per request, amplifying each probe. This issue has been fixed in version 8.31.0. As a workaround, configure the GOTENBERG_API_WEBHOOK_ALLOW_LIST environment variable to restrict webhook URLs to known receivers, or set GOTENBERG_API_WEBHOOK_DENY_LIST to block RFC-1918 and link-local address ranges.