CVE-2026-42591

Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8

CVSS 8.2 HIGHEPSS 0.2%CWE-918

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.2EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

14 mai 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely bypassing the SSRF filters. This vulnerability is fixed in 8.32.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Produtos afetados

gotenberg · gotenberg

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rm4c-xj6x-49mw