Executive brief
Gotenberg is a service used to convert various document formats into PDF files via a web API. A security flaw allows unauthenticated attackers to bypass internal security filters and force the server to make requests to private internal systems or local services. This could lead to the exposure of sensitive internal data or unauthorized access to other services running within the same corporate network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gotenberg's 'downloadFrom' and 'webhook' features due to insufficient validation of user-supplied URLs. The default deny-lists intended to block access to loopback and private IP ranges use case-sensitive regular expressions that only match lowercase 'http://' and 'https://' prefixes. Furthermore, the filtering logic fails to account for alternative IP representations, such as IPv4-mapped IPv6 addresses (e.g., [::ffff:127.0.0.1]). An unauthenticated remote attacker can exploit this to bypass the filter and force the Gotenberg instance to interact with internal-only HTTP services. This issue is resolved in version 8.31.0 by improving the robustness of the URL filtering mechanism.
Affected products
- Gotenberg Gotenberg < 8.31.0
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD