CVE-2026-40893

Gotenberg from version 8.10.0 until 8.33.0 has a race condition in the newContext function in pkg/modules/api/context.go, where multiple goroutines concurrently write to shared maps and slices. A crafted multipart request with many downloadFrom entries can trigger a fatal 'concurrent map writes' runtime error and terminate the process. The default configuration allows unauthenticated remote attacks, leading to denial of service. This issue is fixed in version 8.33.0.

Gotenberg is a PDF file API that prior to version 8.32.0 lacked default protection against HTTP/HTTPS-based SSRF attacks. An attacker could point Chromium at any internal IP and receive a response rendered as a PDF.

Gotenberg is a PDF file API that prior to version 8.30.0 had a vulnerability allowing the bypass of ExifTool's metadata write blocklist. Using ExifTool's group-prefix syntax, an attacker could rename, move, and create hard and soft links on the server.

Gotenberg in version 8.32.0 and earlier has a vulnerability in the IsPublicIP function that does not reject IPv6 prefixes such as 2002::/16, 64:ff9b::/96, fec0::/10, and others that can embed or route to non-public IPv4 destinations. A crafted DNS AAAA record can cause the outbound HTTP client to treat an address wrapping an internal destination (e.g., 169.254.169.254) as public, allowing access to cloud metadata services. This issue is fixed in version 8.33.0.

Gotenberg in version 8.32.0 and earlier has a vulnerability in filename handling where filepath.Base on Linux does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. A remote attacker can submit such a name, and when the resulting archive is extracted on a Windows system, files can be written outside the intended directory. This issue is fixed in version 8.33.0.

A vulnerability in Gotenberg prior to version 8.34.0 allows blind SSRF and limited local file disclosure via a specially crafted document sent to the /forms/libreoffice/convert endpoint. LibreOffice automatically retrieves external HTTP(S) resources and local files during document conversion.

Gotenberg version 8.29.1 has a blind SSRF vulnerability. An unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url header.

Gotenberg versions 8.30.1 and earlier use the regular expression ^https?:// to check URLs in private IP deny-lists. Since Go normalizes the URL scheme to lowercase before establishing a connection, an attacker can bypass the block by using uppercase letters in the scheme (e.g., HTTP://). This allows unauthenticated requests to internal network services, including cloud metadata endpoints.

SSRF vulnerability in Gotenberg before version 8.1.0 allows local file inclusion via the /convert/html endpoint. An attacker can use an iframe pointing to localhost, e.g., <iframe src="\\localhost/etc/passwd">, leading to reading sensitive system files.