Gotenberg vulnerabilities

Products

• Gotenberg 20

Newest

• gotenberg Gotenberg: SSRF via LibreOffice document processing CVE-2026-55229 Fix available 7.5 HighJune 18, 2026
• gotenberg Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CVE-2026-45742 Fix available 7.5 HighMay 29, 2026
• gotenberg Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes CVE-2026-45741 Fix available 7.5 HighMay 29, 2026
• gotenberg Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename CVE-2026-44829 Fix available 8.8 HighMay 29, 2026
• gotenberg Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass CVE-2026-42595 Fix available 8.6 HighMay 11, 2026
• gotenberg Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme CVE-2026-42597 Fix available 5.9 MediumMay 7, 2026
• gotenberg Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook CVE-2026-42596 Fix available 9.4 CriticalMay 7, 2026
• gotenberg Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine CVE-2026-42594 Fix available 7.5 HighMay 7, 2026
• gotenberg Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes CVE-2026-42593 Fix available 5.3 MediumMay 7, 2026
• gotenberg Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes CVE-2026-42592 Fix available 5.3 MediumMay 7, 2026
• gotenberg Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8 CVE-2026-42591 Fix available 8.2 HighMay 7, 2026
• gotenberg Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist CVE-2026-42590 Fix available 8.2 HighMay 7, 2026
• gotenberg Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection CVE-2026-42589 Public exploitFix available 9.8 CriticalMay 7, 2026
• gotenberg Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move CVE-2026-40893 Fix available 8.2 HighMay 4, 2026
• gotenberg Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values CVE-2026-40281 Public exploitFix available 10.0 CriticalApril 30, 2026
• gotenberg Gotenberg unauthenticated blind SSRF via unfiltered webhook URL CVE-2026-39383 Fix available 6.9 MediumApril 30, 2026
• gotenberg Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists CVE-2026-40280 Fix available 7.8 HighApril 30, 2026
• gotenberg Gotenberg has a ReDoS via extraHttpHeaders scope feature CVE-2026-35458 Fix available 8.7 HighApril 7, 2026
• gotenberg Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme CVE-2026-27018 Fix available 7.8 HighMarch 30, 2026
• gotenberg CVE-2024-21527 in github.com/gotenberg/gotenberg CVE-2024-21527 Fix available 8.8 HighJuly 19, 2024