Executive brief
Gotenberg, a tool used to convert various document formats into PDFs, contains a vulnerability that allows unauthorized users to access files belonging to other users. By sending a specially crafted request, an attacker can browse the server's temporary storage and read documents (such as HTML, Markdown, or Office files) while they are being processed. This could lead to the exposure of sensitive information in environments where multiple users share the same Gotenberg service.
Technical details
A vulnerability in Gotenberg's Chromium-based URL conversion and screenshot routes allows for arbitrary file reads within the /tmp directory. The application's default deny-list intentionally exempts the 'file:///tmp/' scheme to allow local asset loading for HTML/Markdown routes, which are protected by a per-request 'AllowedFilePrefixes' guard. However, the URL-based routes fail to populate this guard, causing the enforcement logic to be skipped entirely. An unauthenticated attacker can use the 'file://' scheme to enumerate Gotenberg's working directories in /tmp and exfiltrate the raw source files of other users' active conversion requests. This is a timing-based attack that affects multi-tenant deployments. The issue is addressed in version 8.32.0.
Affected products
- Gotenberg gotenberg/gotenberg/v7 <= 7.10.2
- Gotenberg gotenberg/gotenberg/v8 <= 8.31.0
Timeline
- 2026-04-30: advisory: GitHub Advisory published
- 2026-05-07: disclosed: CVE-2026-42597 published
- 2026-07-21: patched: Advisory updated with patch information for v8.32.0