Thecodingmachine Gotenberg vulnerabilities

• gotenberg Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass CVE-2026-42595 Fix available 8.6 HighMay 11, 2026
• gotenberg Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme CVE-2026-42597 Fix available 5.9 MediumMay 7, 2026
• gotenberg Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook CVE-2026-42596 Fix available 9.4 CriticalMay 7, 2026
• gotenberg Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine CVE-2026-42594 Fix available 7.5 HighMay 7, 2026
• gotenberg Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes CVE-2026-42593 Fix available 5.3 MediumMay 7, 2026
• gotenberg Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes CVE-2026-42592 Fix available 5.3 MediumMay 7, 2026
• gotenberg Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8 CVE-2026-42591 Fix available 8.2 HighMay 7, 2026
• gotenberg Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist CVE-2026-42590 Fix available 8.2 HighMay 7, 2026
• gotenberg Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection CVE-2026-42589 Public exploitFix available 9.8 CriticalMay 7, 2026
• gotenberg Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move CVE-2026-40893 Fix available 8.2 HighMay 4, 2026
• gotenberg Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values CVE-2026-40281 Public exploitFix available 10.0 CriticalApril 30, 2026
• gotenberg Gotenberg unauthenticated blind SSRF via unfiltered webhook URL CVE-2026-39383 Fix available 6.9 MediumApril 30, 2026
• gotenberg Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists CVE-2026-40280 Fix available 7.8 HighApril 30, 2026
• gotenberg Gotenberg has a ReDoS via extraHttpHeaders scope feature CVE-2026-35458 Fix available 8.7 HighApril 7, 2026
• gotenberg Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme CVE-2026-27018 Fix available 7.8 HighMarch 30, 2026
• thecodingmachine gotenberg An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion,... CVE-2020-14160 7.5 HighAugust 26, 2021
• thecodingmachine gotenberg It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg... CVE-2020-14161 6.1 MediumAugust 26, 2021
• thecodingmachine gotenberg Server-side Request Forgery (SSRF) CVE-2021-23345 5.3 MediumFebruary 26, 2021
• thecodingmachine gotenberg A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an... CVE-2020-13449 7.5 HighJanuary 7, 2021
• thecodingmachine gotenberg A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an... CVE-2020-13450 9.8 CriticalJanuary 7, 2021
• thecodingmachine gotenberg An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1... CVE-2020-13451 9.8 CriticalJanuary 7, 2021
• thecodingmachine gotenberg In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg)... CVE-2020-13452 9.8 CriticalJanuary 7, 2021