Executive brief
Gotenberg is a tool used to convert web pages and documents into PDF files. A security flaw allows unauthorized users to force the tool to access internal network resources, such as private company servers or cloud metadata services that contain sensitive credentials. This could lead to the theft of administrative credentials or the exposure of private internal data, which is then returned to the attacker in the form of a PDF document.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url). The default configuration only includes a deny-list for 'file://' URIs, failing to restrict HTTP/HTTPS requests to loopback addresses, RFC 1918 private ranges, or cloud metadata endpoints (e.g., 169.254.169.254). Furthermore, the application fails to re-validate destinations during HTTP redirects; an attacker can provide a URL to a malicious external server that redirects the Chromium instance to an internal target, bypassing even custom deny-lists. This allows unauthenticated remote attackers to exfiltrate sensitive internal data rendered as PDF documents. The issue is resolved in version 8.32.0.
Affected products
- Gotenberg Gotenberg < 8.32.0
Timeline
- 2026-04-30: disclosed: Original advisory published on GitHub
- 2026-05-14: advisory: NVD published the CVE record
- 2026-05-14: patched: Fix released in version 8.32.0