CVE-2026-40280
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Gotenberg versions 8.30.1 and earlier use the regular expression ^https?:// to check URLs in private IP deny-lists. Since Go normalizes the URL scheme to lowercase before establishing a connection, an attacker can bypass the block by using uppercase letters in the scheme (e.g., HTTP://). This allows unauthenticated requests to internal network services, including cloud metadata endpoints.
Risk Assessment
An attacker can access internal network resources, such as cloud instance metadata (e.g., HTTP://169.254.169.254/latest/meta-data/), potentially leading to sensitive data leakage or further compromise.
Recommendation
Upgrade Gotenberg to version 8.31.0, which contains the fix. As a temporary measure, add additional blocking rules or use a firewall.
Other vulnerabilities in Gotenberg
See all- CVE-2026-45742High
Gotenberg from version 8.10.0 until 8.33.0 has a race condition in the newContext function in pkg/modules/api/context.go, where multiple goroutines concurrently write to shared maps and slices. A crafted multipart request with many downloadFrom entries can trigger a fatal 'concurrent map writes' runtime error and terminate the process. The default configuration allows unauthenticated remote attacks, leading to denial of service. This issue is fixed in version 8.33.0.
- CVE-2026-42595High
Gotenberg is a PDF file API that prior to version 8.32.0 lacked default protection against HTTP/HTTPS-based SSRF attacks. An attacker could point Chromium at any internal IP and receive a response rendered as a PDF.
- CVE-2026-42590High
Gotenberg is a PDF file API that prior to version 8.30.0 had a vulnerability allowing the bypass of ExifTool's metadata write blocklist. Using ExifTool's group-prefix syntax, an attacker could rename, move, and create hard and soft links on the server.
- CVE-2026-40893High
Gotenberg is a stateless API for PDF files that prior to version 8.31.0 did not properly check tags, allowing remote attackers to move, rename, and change permissions for arbitrary files.
- CVE-2026-45741High
Gotenberg in version 8.32.0 and earlier has a vulnerability in the IsPublicIP function that does not reject IPv6 prefixes such as 2002::/16, 64:ff9b::/96, fec0::/10, and others that can embed or route to non-public IPv4 destinations. A crafted DNS AAAA record can cause the outbound HTTP client to treat an address wrapping an internal destination (e.g., 169.254.169.254) as public, allowing access to cloud metadata services. This issue is fixed in version 8.33.0.
- CVE-2026-44829High
Gotenberg in version 8.32.0 and earlier has a vulnerability in filename handling where filepath.Base on Linux does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. A remote attacker can submit such a name, and when the resulting archive is extracted on a Windows system, files can be written outside the intended directory. This issue is fixed in version 8.33.0.
- CVE-2026-55229High
A vulnerability in Gotenberg prior to version 8.34.0 allows blind SSRF and limited local file disclosure via a specially crafted document sent to the /forms/libreoffice/convert endpoint. LibreOffice automatically retrieves external HTTP(S) resources and local files during document conversion.
- CVE-2026-39383High
Gotenberg version 8.29.1 has a blind SSRF vulnerability. An unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url header.
- CVE-2024-21527High
SSRF vulnerability in Gotenberg before version 8.1.0 allows local file inclusion via the /convert/html endpoint. An attacker can use an iframe pointing to localhost, e.g., <iframe src="\\localhost/etc/passwd">, leading to reading sensitive system files.
Original NVD description (English source)
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data/. This bypasses the same security control that was patched in CVE-2026-27018. This issue has been fixed in version 8.31.0.