Executive brief
Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3) in github.com/gotenberg/gotenberg
Affected products
- Go github.com/gotenberg/gotenberg/v8
- Go github.com/gotenberg/gotenberg/v7
Junglewise Threat Intelligence
CVE-2026-27018: GO-2026-4905 - Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3) in github.com/gotenberg/gotenberg
CVE-2026-27018 · Severity: medium · CVSS 4 · Published 2026-04-02
Technologies: github.com/gotenberg/gotenberg/v8 (Go), github.com/gotenberg/gotenberg/v7 (Go). Vendors: Go.
Related threats
- Gotenberg SSRF and local file disclosure in LibreOffice conversion
- GO-2026-5587 - Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags in github.com/gote
- GO-2026-5372 - Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature in github.com/gotenberg/gotenberg
- Gotenberg race condition in multipart downloadFrom handling
- Gotenberg SSRF deny-list bypass in IsPublicIP via IPv6 prefixes