Executive brief
Gotenberg is a tool used to convert various document formats into PDF files via a web interface. A security flaw allows attackers to upload specially crafted documents that force the server to make unauthorized network requests to internal systems or cloud metadata services. This could lead to the theft of sensitive credentials or the exposure of private internal data that is otherwise inaccessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gotenberg's LibreOffice conversion endpoint (/forms/libreoffice/convert). While Gotenberg implemented SSRF hardening in version 8.31.0 for its Go-based components, the LibreOffice subprocess operates independently and bypasses these filters when processing documents with embedded external URLs (e.g., OOXML files with 'External' TargetMode relationships). An unauthenticated remote attacker can upload a crafted document (DOCX, XLSX, etc.) containing external references, causing the LibreOffice process to fetch remote content. This can be used to exfiltrate data from internal services, access cloud metadata (169.254.169.254), or perform internal port scanning. The issue is resolved in version 8.32.0 by isolating the LibreOffice process network namespace.
Affected products
- Gotenberg Gotenberg <= 8.31.0
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD