Is CVE-2026-42597 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42597 being exploited in the wild.

How severe is CVE-2026-42597?

Medium severity, with a CVSS score of 5.9, published 14 May 2026.

Which products and versions are affected?

github.com/gotenberg/gotenberg/v7 (Go) <= 7.10.2, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=7.10.2; github.com/gotenberg/gotenberg/v8 (Go) <= 8.31.0, SEMVER:introduced=0,fixed=8.32.0; Gotenberg <= 7.10.2, <= 8.31.0.

Is there a fix for CVE-2026-42597?

Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42597 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42597?

Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42597: Gotenberg SSRF and Information Disclosure in Chromium URL routes

Q: Is there a fix for CVE-2026-42597?

Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42597 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-42597?

Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42597 · Severity: medium · CVSS 5.9 · Published 2026-05-14

Gotenberg, a tool used to convert various document formats into PDFs, contains a vulnerability that allows unauthorized users to access files belonging to other users. By sending a specially crafted request, an attacker can browse the server's temporary storage and read documents (such as HTML, Markdown, or Office files) while they are being processed. This could lead to the exposure of sensitive information in environments where multiple users share the same Gotenberg service.

Technologies: github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go), Gotenberg. Vendors: Go, Gotenberg.

Quick answers

Is CVE-2026-42597 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42597 being exploited in the wild.
How severe is CVE-2026-42597?: Medium severity, with a CVSS score of 5.9, published 14 May 2026.
Which products and versions are affected?: github.com/gotenberg/gotenberg/v7 (Go) <= 7.10.2, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=7.10.2; github.com/gotenberg/gotenberg/v8 (Go) <= 8.31.0, SEMVER:introduced=0,fixed=8.32.0; Gotenberg <= 7.10.2, <= 8.31.0.
Is there a fix for CVE-2026-42597?: Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42597 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42597?: Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.32.0 or later
```
go get github.com/gotenberg/gotenberg/v8@v8.32.0
```

Technical details

A vulnerability in Gotenberg's Chromium-based URL conversion and screenshot routes allows for arbitrary file reads within the /tmp directory. The application's default deny-list intentionally exempts the 'file:///tmp/' scheme to allow local asset loading for HTML/Markdown routes, which are protected by a per-request 'AllowedFilePrefixes' guard. However, the URL-based routes fail to populate this guard, causing the enforcement logic to be skipped entirely. An unauthenticated attacker can use the 'file://' scheme to enumerate Gotenberg's working directories in /tmp and exfiltrate the raw source files of other users' active conversion requests. This is a timing-based attack that affects multi-tenant deployments. The issue is addressed in version 8.32.0.

Affected products

Gotenberg gotenberg/gotenberg/v7 <= 7.10.2
Gotenberg gotenberg/gotenberg/v8 <= 8.31.0

Identifiers

CVE-2026-42597
GHSA-g924-cjx7-2rjw
GO-2026-5395

Timeline

2026-04-30: advisory: GitHub Advisory published
2026-05-07: disclosed: CVE-2026-42597 published
2026-07-21: patched: Advisory updated with patch information for v8.32.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.