Executive brief
Gotenberg is a tool used to convert various document formats into PDF files. A security flaw in its document conversion process allows an attacker to upload a specially crafted file that forces the server to make unauthorized network requests or read local files. This could lead to the exposure of internal network information or sensitive files stored on the server.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gotenberg's /forms/libreoffice/convert endpoint due to insufficient restrictions on linked resources during document conversion. An attacker can submit a document (e.g., DOCX) containing tags that reference external HTTP(S) URLs or local file paths. LibreOffice, acting as the conversion engine, automatically retrieves these resources, leading to blind SSRF or the embedding of local image files into the resulting PDF. The root cause was the lack of the 'BlockUntrustedRefererLinks' configuration in the LibreOffice profile. This issue is resolved in version 8.34.0 by blocking content linked from untrusted locations.
Affected products
- Gotenberg Gotenberg < 8.34.0
Timeline
- 2026-06-11: patched: Fix committed to repository
- 2026-06-12: advisory: Release 8.34.0 published
- 2026-07-10: disclosed: CVE published to NVD